![\"David](\"https:\/\/www.newsbeep.com\/au\/wp-content\/uploads\/2025\/12\/b3a5e27b67bafef557dc9d266c430580bca7aae2.png\")
Save<\/p>\nSave<\/p>\n
You have reached your maximum number of saved items.<\/p>\n
Remove items from your saved list<\/a> to add more.<\/p>\n AAA<\/p>\n The parent company of Canvas, the online learning platform used by hundreds of thousands of Australian students and teachers, has struck a deal with the cybercriminal gang that stole personal data from an estimated 275 million users and sought a $13 million ransom.<\/p>\n Instructure confirmed early Wednesday AEST that it had \u201creached an agreement with the unauthorised actor\u201d responsible for the attack, which crippled Canvas in the final weeks of first semester<\/a> and took roughly 3.65 terabytes of student and staff records from 8,809 educational institutions worldwide – including at least 122 in Australia.<\/p>\n The company stopped short of confirming a ransom payment, saying only that the stolen data had been returned alongside \u201cshred logs\u201d – digital confirmation the hackers had destroyed any remaining copies.<\/p>\n \u201cWhile there is never complete certainty when dealing with cybercriminals, we believe it was important to take every step within our control to give customers additional peace of mind,\u201d Instructure said.<\/p>\n Australian victims include the University of Melbourne, University of Sydney, University of Technology Sydney, RMIT, Western Sydney University, the University of Newcastle, Australian Catholic University and the Victorian and Queensland Departments of Education. Private schools including Melbourne Grammar, Cranbrook School in Sydney and Brisbane Grammar are also among Instructure\u2019s local customers.<\/p>\n Signs of the hack emerged last week<\/a> and many institutions had already restored access to Canvas before the ransom was paid.<\/p>\n Cybersecurity consultant Luke Irwin, of Aegis Cybersecurity, said the hacking group ShinyHunters had been seeking a ransom of about $US10 million, suggesting any eventual payment was likely \u201cin the high single-digit millions.\u201d Instructure is owned by US private equity giant KKR, and Irwin said the incident may yet surface through KKR\u2019s investor reporting or the US Securities and Exchange Commission\u2019s mandatory cyber-incident disclosures.<\/p>\n The hackers accessed student ID numbers, email addresses, names and private Canvas messages, threatening to dump the trove publicly unless schools paid up. Instructure claims no passwords, dates of birth, government identifiers or financial information were taken.<\/p>\n Alastair MacGibbon, Australia\u2019s former cyber tsar and now chief strategy officer at CyberCX, said Instructure\u2019s carefully worded statement was almost certainly code for a paid ransom, and one that demanded a far better explanation.<\/p>\n \u201cReaching an agreement, I would suggest, is code for paid,\u201d he told this masthead. \u201cI\u2019m not against paying in certain circumstances. If someone has locked up a hospital system or a power company, or something that will have catastrophic consequences for human lives or for the survival of an economy, then payment has to always be a potential option. But in this type of circumstance, most people would question how an organisation would think that was justifiable.\u201d<\/p>\n He warned that victims, including students, should not assume the data was now safe. \u201cCriminal assurances that they won\u2019t on-sell the information, or that they\u2019ve deleted it, have been proven time and time again to be inaccurate, or lies.\u201d<\/p>\n MacGibbon said the involvement of children might be a \u201csemi-valid argument\u201d for negotiating, but Instructure could not simply leave it implied. \u201cYou can\u2019t just say we\u2019ve reached an agreement with the criminals and they\u2019ve told us they\u2019re not going to release anything. It\u2019s just not acceptable. You\u2019ve got to come out and give justifications.\u201d<\/p>\n Instructure was contacted for further comment. It is legal in Australia to pay a ransom to hackers, as long as they are not a sanctioned entity.<\/p>\n A class action filed in a US federal court in Utah last week alleges Instructure failed to adequately protect its platform and made itself \u201ceasy prey for cybercriminals\u201d. ShinyHunters previously breached the company in 2024 via third party software, and this time exploited a flaw in Canvas\u2019 Free-for-Teacher program, which allowed educators to sign up without institutional verification.<\/p>\n The incident, which is believed to be the largest education-sector breach on record, will reignite debate about Australia\u2019s reliance on overseas software platforms holding sensitive data on millions of children.<\/p>\n Traditionally, Mr MacGibbon noted, ransom demands \u201cwill exceed what gets paid\u201d, with significant discounts negotiated, but he said the size of any payment was beside the point.<\/p>\n \u201cThis is an organisation most people have never heard of that actually serviced 8,000 institutions globally,\u201d he said. \u201cA single compromise, reasonably unsophisticated, leads to harm against millions of people. It highlights the complexity of supply chains. It should be a wake-up call for anyone else that operates an IT helpdesk or a workforce with access to these types of massive amounts of data.\u201c<\/p>\n The Business Briefing newsletter delivers major stories, exclusive coverage and expert opinion. Sign up to get it every weekday morning<\/a>.<\/p>\n Save<\/p>\n You have reached your maximum number of saved items.<\/p>\n Remove items from your saved list<\/a> to add more.<\/p>\n![\"The](\"https:\/\/www.newsbeep.com\/au\/wp-content\/uploads\/2026\/05\/939d3f604d058c4c215da432caa389649c656f0f.jpeg\")
The parent company of Canvas, the online learning platform used by hundreds of thousands of Australian students and teachers, has struck a deal with the cybercriminal gang behind a global breach to delete the personal data of an estimated 275 million users.<\/p>\n![\"Australia\u2019s](\"https:\/\/www.newsbeep.com\/au\/wp-content\/uploads\/2026\/05\/5fe2442fc5f682922a1d277b112c142c74673789.jpeg\")
Australia\u2019s former cyber tsar Alastair MacGibbon.Oscar Colman<\/p>\n![\"David](\"https:\/\/www.newsbeep.com\/au\/wp-content\/uploads\/2025\/12\/1765876452_771_b3a5e27b67bafef557dc9d266c430580bca7aae2.png\")
David Swan<\/a> is the technology editor for The Age and The Sydney Morning Herald. He was previously technology editor for The Australian newspaper.Connect via X<\/a> or email<\/a>.From our partners<\/p>\n","protected":false},"excerpt":{"rendered":"Save You have reached your maximum number of saved items. Remove items from your saved list to add…\n","protected":false},"author":2,"featured_media":667226,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[64,63,44],"class_list":["post-667225","post","type-post","status-publish","format-standard","has-post-thumbnail","category-australia","tag-au","tag-australia","tag-news"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/posts\/667225","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/comments?post=667225"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/posts\/667225\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/media\/667226"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/media?parent=667225"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/categories?post=667225"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/tags?post=667225"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}