House Committee Demands Instructure Testimony on Canvas Data Breaches

U.S. House lawmakers are demanding that representatives from Instructure testify about the company's response to two cyberattacks that allowed hackers to steal personal data from millions of students worldwide. The House Homeland Security Committee is investigating the incidents, citing its jurisdiction over government activities relating to homeland security.

The committee's chair wrote in a letter to the company that the panel seeks details on how hackers broke into Instructure's systems on both occasions, the types of data taken, the company's response to the attacks, and its process for notifying affected schools.

The letter also asks about the adequacy of Instructure's coordination with the U.S. cybersecurity agency CISA, which has been called in to help with the incident. The committee cited reporting by TechCrunch in its letter. Instructure makes the Canvas school information portal software used by educational institutions.

The company faced criticism after it acknowledged that the hackers used the same vulnerability to steal sensitive student data and later deface school login pages.

This week Instructure confirmed it reached an agreement with the hackers. The company stated that the hackers provided evidence they had deleted the stolen data. A representative for the ShinyHunters hackers told TechCrunch that the group would not continue to extort the company or its customers. The representative declined to say how much the company had paid as ransom.

The committee chair stated that the second breach by the same hackers raises serious questions about the company's incident response capabilities and its obligations to the institutions and individuals whose data it holds. The letter described the scale and timing of the breaches, along with the company's inability to contain the threat actor after the initial intrusion, as systemic vulnerabilities the committee has a responsibility to examine.

Instructure has not said whether it will respond to the letter or provide testimony. A company spokesperson did not respond to a request for comment.