US Lawmakers Demand Answers from Instructure After Canvas Data Breaches

U.S. House lawmakers are putting pressure on Instructure, the developer of widely-used education software Canvas, to answer questions about their handling of two significant data breaches.

The Cybersecurity Crisis

In a letter to Instructure's CEO Steve Daly, Representative Andrew Garbarino from the House Homeland Security Committee is demanding a testimony. The committee is investigating the cyberattacks that led to the theft of personal information from millions of students worldwide.

Why It Matters

The breach raises serious concerns about Instructure's cybersecurity practices and its response mechanisms. CISA, the U.S. Cybersecurity and Infrastructure Security Agency, has been called in to assist with the investigation.

Previous Hacks and Criticisms

Instructure, which was already criticized for its initial response to the data breaches, recently confirmed it 'reached an agreement' with hackers. However, the company's claims that hackers deleted stolen data are met with skepticism from security experts.

Complicated Negotiations

A representative of the ShinyHunters hackers told TechCrunch they will not continue to extort Instructure or its customers but declined to disclose payment amounts. Security experts warn that paying hackers can fund future attacks and may not ensure data deletion.

Committee's Concerns

Garbarino emphasized the seriousness of the situation, stating, 'The scale and timing of the Instructure breach, and the demonstrated inability of a major educational technology vendor to contain a threat actor following an initial intrusion, are precisely the kind of systemic vulnerabilities this Committee has a responsibility to examine.'

Uncertain Future

Instructure has not yet responded to the letter or indicated whether Daly will testify. A spokesperson for Instructure did not comment on Wednesday.