Cyberattack Hits Canvas Instructure: Ransomware Deal Made, But Personal Data May Still Be Vulnerable

A cyberattack has caused significant disruptions to universities nationwide, resulting in a digital blackout. A former White House official has revealed that artificial intelligence played a role in this attack. Although the affected company paid a ransom to regain control of its system and ensure that hackers deleted the stolen data, there’s concern that compromised personal information might still be circulating, posing risks to many individuals.

“The ransomware issue is escalating rather than improving. The involvement of AI, which seems to make hacking easier and more widespread, is particularly troubling,” stated Jake Braun, a former deputy national cyber director at the White House and current head of the University of Chicago’s Cyber Policy Initiative.

ABC7 Chicago is now streaming 24/7. Click here to watch

According to Braun, the recent ransomware attack on the Canvas educational platform by Instructure is just the latest in a series of increasingly frequent cyberattacks.

“While high-profile cases like this one make headlines, during my tenure at the White House, the real concern was the numerous unreported attacks, where victims simply pay the ransom and move forward,” Braun explained to the I-Team.

He highlighted that ransomware attacks are rapidly becoming one of the most lucrative criminal activities globally.

“We believe we’re only aware of a small portion of the attacks that are actually happening,” Braun added.

The attack on Canvas delayed finals and locked out teachers and students from the platform with critical risks persisting, despite an agreement from its parent company to pay hackers to delete stolen data.

“One of the fastest growing groups in the world that’s getting scammed online is youth, and so, I do wonder what these criminal groups will do with all this data to potentially swindle young people who are in college,” said Braun.

He says as an educator himself, he’s skeptical of any communications he receives from Canvas right now.

“I haven’t opened one email one email since this happened, because I don’t feel like I can trust what emails are real or not,” said Braun.

He advises people to call their school IT department to confirm whether an email is legitimate, turn on multifactor authentication if possible, and only go directly to the Canvas website to log in to help ensure your data isn’t falling into the wrong hands.

“We’re more vulnerable than ever particularly with how AI is making this so much easier for bad guys,” Braun told the I-Team. “Law enforcement is not resourced to go after these ransomware groups. If we want to actually get a handle on this… We need to be spending a lot more time and energy with federal law enforcement to go after these ransomware groups that are spread all over the world.”

In an update from Canvas parent company Instructure, they said in their agreement with the hackers, the data was returned, they received digital confirmation of data destruction, and they have been informed no Instructure customers will be extorted as a result of this incident. Braun says this is another example of cyber vulnerability to not just bad actors looking for money but nation-states such as Iran, China, and Russia.