US lawmakers demand answers from Instructure after Canvas data breaches

U.S. lawmakers are calling for Instructure, the education software company that has suffered two significant cyberattacks, to provide answers regarding its handling of data breaches that compromised the personal information of millions of students globally. The House Homeland Security Committee, which oversees activities related to national security, is investigating these incidents, as noted by Committee Chair Representative Andrew Garbarino in a letter addressed to Instructure's CEO, Steve Daly. The committee has sought the expertise of the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to assist with the ongoing investigation. Garbarino’s letter emphasizes the need for Daly to testify about how hackers have successfully infiltrated Instructure's systems multiple times, as well as the specific types of data that were stolen. Lawmakers are also interested in understanding how the company is informing affected educational institutions about the breaches and whether its collaboration with CISA has been sufficient. Instructure, known for its widely used Canvas platform in educational settings, has been criticized for its inadequate response to these attacks. Reports indicate that hackers exploited the same security vulnerability to both steal sensitive student data and deface school login pages. Recently, Instructure announced it had reached an agreement with the hackers, suggesting they provided proof of data deletion. However, a spokesperson for the ShinyHunters hacking group informed TechCrunch that they would cease extorting Instructure but did not disclose the ransom amount paid. Security analysts caution that paying ransoms may only reinforce the cycle of cyberattacks. It is not uncommon for attackers to retain stolen information even after claiming to have removed it, potentially setting the stage for future extortion attempts. Garbarino expressed concern over the repeated breaches, highlighting the pressing questions surrounding Instructure's cybersecurity protocols and its responsibilities to safeguard the data of its clients. "The magnitude and timing of the Instructure breach, coupled with the evident failure of a key educational technology provider to mitigate threats after an initial breach, underscore systemic vulnerabilities that warrant thorough examination by this Committee," Garbarino stated in his letter. As of now, Instructure has not indicated whether it will respond to the committee's request for testimony, nor has it confirmed who will address cybersecurity issues on behalf of the company. A request for comments from Instructure's spokesperson Brian Watkins went unanswered as of Wednesday.