US govt seeks Instructure testimony on massive Canvas cyberattack

The ShinyHunters extortion group conducted two attacks against Instructure's Canvas platform: a large-scale data theft (claimed ~280 million records containing names, emails, student IDs and messages) and subsequent defacements of Canvas login portals using cross-site scripting to obtain admin sessions. The incidents disrupted exams across many U.S. schools, prompted a U.S. House Homeland Security Committee inquiry into Instructure's incident response, and ended with the attacker removing the public leak after Instructure reportedly reached an agreement with the group.