Instructure Reaches Agreement to Securely Delete Stolen Student Data from Canvas Breach

Instructure, the company behind the Canvas learning platform, reported that it has reached an agreement with hackers responsible for stealing 3.5 terabytes of data from students and universities. According to the company, they received digital confirmation that the stolen information has been destroyed, ensuring that affected schools and students will not face extortion. While paying cybercriminals is generally discouraged by law enforcement agencies worldwide, Instructure stated that their primary goal was to protect the data of students and education staff. Past incidents have shown that paying ransom does not guarantee data deletion, as some criminal groups have retained the information despite receiving payments. Instructure clarified that the agreement included the return of data, digital confirmation of its destruction, assurance that no customers would be extorted, and coverage for all affected users without requiring individual engagement with the hackers. The company emphasized that while certainty can never be absolute when negotiating with cybercriminals, the steps taken were intended to provide additional peace of mind to their customers. This incident highlights ongoing cybersecurity challenges in the education sector and the complex decisions companies face in responding to data breaches.