Summary Points
- Lawmakers are questioning Instructure’s response and incident handling after its Canvas LMS was compromised twice in a week by ShinyHunters, raising concerns about vulnerabilities and breach management.
- Instructure temporarily took Canvas offline following initial breaches but was later attacked again, with the hackers posting ransom demands and claiming access to over 3TB of user data from more than 9,000 institutions.
- The company’s statement suggests it reached an agreement with the attackers and that no customer will be extorted, but evidence indicates it may have paid a ransom, as the attackers removed their data from leak sites.
- Previous security incidents, including a September 2025 Salesforce breach linked to ShinyHunters, show Instructure is a repeated target, and experts warn that threat actors could reuse compromised data for future attacks.
Congress Questions Instructure After Canvas Outage
Recently, a major outage affected Instructure’s Canvas learning management system. Lawmakers are now demanding answers. The House Committee on Homeland Security has asked the company to explain the recent cybersecurity breaches. Specifically, they want to know why Instructure was hacked twice in one week. The committee also questions if the company paid a ransom to the hackers. This incident is raising concerns about the company’s ability to protect student and staff data. Instructure temporarily shut down Canvas to investigate the attack but then announced it was fully operational again. However, hackers returned the next day, posting a ransom demand and compromising the platform further. Lawmakers see this as a sign of possible weaknesses in Instructure’s security measures and are eager to understand what went wrong.
Allegations of Ransom Payment and Past Security Flaws
Another focus for lawmakers is whether Instructure paid the ransom money. A letter to the company asks about this, along with details of the data affected. The company says they managed to get the stolen data back and that the hackers destroyed it. But many suspect that a ransom was paid, especially since the hackers removed their threat from online leak sites. Instructure previously experienced a hacking incident linked to its Salesforce system last fall. That breach involved a social engineering attack and led to the exposure of sensitive information. Security experts highlight that hackers like ShinyHunters often target such organizations repeatedly. They warn that Instructure’s ongoing targeting means schools relying on Canvas must stay vigilant. As the digital landscape grows, keeping online educational tools safe remains critical for supporting education and the human journey.
Stay Ahead with the Latest Tech Trends
Explore the future of technology with our detailed insights on Artificial Intelligence.
Explore past and present digital transformations on the Internet Archive.
CyberRisk-V1
