Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Latest News

Quasar Linux Malware Targets Developers in Stealthy Supply Chain Attack

  A newly discovered Linux implant called Quasar Linux, or QLNX, is a serious threat because it goes after the people and systems that build...

All the recent news you need to know
Infrastructure Security
API Cyber Attacks Cybersecurity Attack DDoS DDOS Attacks Hacker attack Infrastructure Security

Ubuntu DDoS Attack Disrupts Installs Updates and Canonical Infrastructure

 

A wave of traffic overwhelmed systems, briefly halting downloads, patches, and web resources managed by Canonical - the team responsible for Ubuntu Linux. Outages stretched nearly twenty-four hours, blocking access to essential tools during the incident. 

Midway through the disruption, Canonical confirmed issues affecting its online systems, calling them a prolonged international cyber incident. With efforts already underway to bring functions back online, progress reports were expected later via verified sources after conditions improved. 

Not just external sites felt the impact - insights from casual chats on unaffiliated Ubuntu message boards pointed to deeper issues. Failures popped up across several core functions: the security API stumbled, repository access broke, setup tools froze, package upgrades failed. When the outage struck, countless machines could neither pull patches nor start clean installs. The ripple spread wider than first assumed. 

A claim of responsibility emerged afterward, attributed to an entity calling itself The Islamic Cyber Resistance in Iraq 313 Team. Supposed messages circulated on Telegram suggest they relied on a service named Beemed - one that facilitates distributed denial-of-service attacks - to execute the incident. While details remain sparse, the method points toward accessible cyber tools being leveraged for disruptive purposes. Heavy network floods emerge when tools like Beamed hand out DDoS power to anyone willing to pay, masking harm behind so-called "testing" labels. 

Instead of building safeguards, some misuse these setups to drown web systems in endless data streams. With advertised force climbing toward 3.5 terabits each second, one sees how readily extreme digital pressure becomes a purchasable option. A single flood of fake signals can overwhelm digital infrastructure when launched from countless hijacked gadgets online. 

Such an event forces critical systems to choke on excessive demand, blocking normal access. Real people experience delays or complete service failures as their requests get lost in chaos. Machines turned into unwilling helpers generate relentless noise instead of useful responses. Performance drops sharply once capacity limits are breached without warning. Genuine interactions fade under pressure from artificial congestion. 

Most times, hacking groups start by slipping malicious software onto gadgets, sometimes using poor login codes instead of strong ones. From there, machines already taken over get bundled together - forming massive clusters run from far away via command centers online. These hijacked setups often change hands in hidden digital bazaars; launching short outages becomes possible for cheap, while heavier assaults require deeper spending. 

What follows? Buyers pick time-limited chaos or go all-in for longer surges. Surprisingly, more DDoS attacks happen now due to widespread access to self-running malware that exploits weak device protections across countries. While strong networks may resist some threats, major companies still face interruptions since hackers pair huge bot-driven data floods with focused attack plans.  

The Ubuntu event underscores how fragile key open-source tools have become - tools that developers, businesses, and public agencies depend on worldwide. When update servers or security interfaces go offline briefly, ripple effects follow. Patching halts. System rollouts stall. All of this unfolds while digital attacks are already underway.
Read more »
Tech
Banks Cyber Security Data Data Leak digital scam identity Scam Tech

High Court Squashes Ban for Sim-Swap Fraud, Says Zero Customer Liability


In an important ruling amid surging digital financial fraud attacks, the Bombay HC sided with the customer protection norms. It directed Bank of Baroda to return Rs. 1.24 crore to the victim private firm that lost money in a SIM-swap case. The court stressed that if a consumer reports fraud promptly in time, “zero liability” is ruled, and the bank must reimburse the losses.                 

Private company reported the incident immediately

The order was given by a division bench of the HC, which included Justices Manjusha Deshpande and Bharati Dangre, when private company PNP Polytex (based in Mumbai) submitted a petition. Polytex alleged that Rs.1.24 crore had been stolen from its bank accounts illegally and without knowledge. 

About court proceedings

As per the submissions to the court, the firm informed the bank soon after finding malicious transactions and asked the accounts to be frozen. The bank could only save Rs. 47.8 lakh, the remaining money was already stolen by the hackers. After this, the firm moved to HC for help.

Later, enquiry revealed that the scam was done using a SIM-swap tactic, where hackers get control of the target’s registered contact number. This lets the hackers intercept OTPs and do banking transactions without the account owner's consent and knowledge. The high court found that the scam was done by third-parties, and showed no evidence of negligence on consumer’s end.

What is RBI’s zero liability rule?

During the proceedings, the court referred to the July 6, 2017 statement given by the RBI, which laid down the customer protection guidelines in incidents of illegal electronic banking transactions. According to the circular, the consumers are entitled to zero liability if they report fraud transactions within 72 hours (three days).

In the judgement, the high court stressed that if a customer informs the bank about a scam or fraud, it is the duty of the bank to return the disputed amount back to the victim’s account. The court also said that the burden of proving customer negligence is on the bank too.  

The court rejected the bank's defenses that it had followed the due process and security measures, and the bench  labelled the argument as a “lame excuse,” saying that such mechanisms become powerless when a SIM card is hacked. The court also attributed another ruling in an incident where HDFC bank was held liable under similar situations. 

Bank will return stolen amount with interest

After revising the previously frozen funds, the High Court ordered the bank to return the remaining sum plus 6% interest within eight weeks. 

Read more »
Siri Vulnerability
Apple Security Bluetooth Forensics Crypto Wallet cryptocurrency theft Cybercrime Investigation digital surveillance FakeWallet Campaign iOS security malware Siri Vulnerability

Apple Account Data and Bluetooth Signals Tie Suspect to Crypto Robbery


 

The App Store ecosystem has been infiltrated by a coordinated wave of fraudulent cryptocurrency wallet applications that exploit regional platform restrictions and user trust to steal credentials from iOS users. More than two dozen malicious apps have been identified as related to a campaign called "FakeWallet," which has been active since at least late 2025 and was designed to harvest passwords and private keys from unsuspecting users via the use of various malware programs.

During the early months of March, counterfeit wallet applications became prominent in search results within China’s App Store after they began appearing prominently in search results, posing a threat to the legitimacy of several legitimate crypto wallet services due to regulatory restrictions. 

In addition to replicating the trusted wallet branding, abusing typosquatting techniques and embedding deceptive prompts leading users towards unofficial wallet downloads, the campaign blurred the distinction between genuine financial tools and malicious software, significantly increasing iPhone users' chances of committing cryptocurrency theft. 

During technical analysis, Kaspersky determined that phishing applications were primarily used as delivery mechanisms for trojanized cryptocurrency wallet software to be installed via browsers. According to the researchers, malicious payloads are commonly embedded through third-party libraries embedded within the applications, despite several samples demonstrating direct modifications of the wallet code itself, indicating a more sophisticated level of tampering. 

Through reverse engineering, special routines have been found that can intercept and exfiltrate recovery phrases as well as seed phrases, while simultaneously manipulating the wallet restoration process for recovering hot wallets. The investigation also identified two separate implants targeting cold wallets hosted on Ledger, extending the campaign's scope beyond software-based assets to hardware wallet users as well. 

A counterfeit website impersonating Ledger's official platform was also discovered by researchers, which distributed malicious iOS application links and compromised Android wallet packages hosted on Chinese-language phishing websites outside of Google Play. It is unclear whether the malware modules had geographic enforcement mechanisms despite the infrastructure and linguistic indicators suggesting that Chinese-speaking victims were targeted. 

It is of concern that the campaign may easily be extended to international targets based on some phishing prompts that dynamically adapt to the language settings of the infected application. Furthermore, the operation has been linked to the previously identified SparkKitty malware cluster, which was discovered last year, based on overlapping distribution tactics, cryptocurrency-centered targeting patterns, Chinese-language debugging strings within the malicious code, and the inclusion of SparkKitty-related components within several analyzed programs. 

When the findings were disclosed to Apple, they were notified and the identified malicious applications have since been removed from the App Store. According to court records reviewed by Forbes, the incident occurred as a result of a targeted home invasion last month in Winnetka, where attackers allegedly used social engineering tactics to gain physical access to the victim's property. 

Investigators reported that a man impersonating a food delivery driver approached the residence and knocked on the front door before at least four armed accomplices gained access moments after the resident responded. Once inside, the group demanded access to a secure safe as well as credentials related to online cryptocurrency accounts, emphasizing the increasing convergence between the targeting of digital assets and conventional violent crimes.

A report by authorities indicates that the operation failed in achieving its intended objective after the victim escaped the residence, leading the suspects to depart the scene without obtaining any known cryptocurrency assets. 

In spite of the attempted robbery, organized groups have increasingly combined physical coercion with identity deception and intelligence-driven targeting to compromise high-value cryptocurrency holders. It is believed that the investigation developed into a broader criminal case involving Chicago rapper Lil Zay Osama, formally known as Isaiah Dukes, along with five additional suspects, were alleged to have kidnapped children and committed a violent cryptocurrency-related robbery. 

Dukes has entered a not guilty plea to the latest charges after previously serving a 14-month prison sentence for unlawful possession of a machine gun in 2024. According to reports, investigators used unconventional but highly effective digital forensics methods in order to identify members of the group after one suspect connected his iPhone to a stolen getaway vehicle's Bluetooth interface.

The combination of the infotainment pairing logs and the subpoenaed Apple records provided authorities with information that allowed them to locate the connected device in a iCloud account belonging to Tyrese Fenton-Watson. The discovery was significant as it demonstrated how telemetry generated by connected consumer technologies, such as smartphone synchronization and in-vehicle wireless systems, is becoming an increasingly important tool for criminal investigations in modern times.

Technology and cybersecurity landscapes were also subject to increasing scrutiny due to the emergence of artificial intelligence, surveillance practices, and digital governance concerns. Anthropic's reported intention to broaden access to its advanced "Mythos" model, which was originally restricted to approximately 40 organizations due to concerns surrounding misuse of the system and offensive security applications. This model is designed with large-scale cyber vulnerability discovery capabilities and is designed to detect cyber vulnerabilities on a large scale.

Reports in The Wall Street Journal indicated that the company hoped to expand its availability to approximately 120 companies, though White House officials expressed reservations about both national security implications and the potential strain on Anthropic's infrastructure and disruption of government access to the technology that could result from excessive external usage. 

In addition, further revelations indicated that the boundary between the deployment of AI, the privacy of users, and digital surveillance is increasingly blurred. In a report published by Wired, it was reported that the DHS had requested location and identification information from Google regarding a Canadian user who criticized the Trump administration, but it is unclear whether Google complied with this request. 

Additionally, Meta disclosed that Facebook and Instagram were using artificial intelligence-driven bone structure analysis to detect whether users are under the age of 13. According to security researcher Jeremiah Fowler, nearly 90,000 screenshots allegedly extracted from a celebrity's smartphone had been exposed as a result of spyware exposure, including sensitive photos, financial records, and private conversations, further illustrating the degree of personal data risks associated with commercial surveillance tools.

A significant amount of industry attention was also drawn to Forbes' publication of its eighth annual AI 50 ranking in partnership with Mayfield, highlighting some of the leading private AI firms, including Harvey and ElevenLabs, along with emerging startups, including Gamma, Chai Discovery, and Rogo. In addition, the AI 50 Brink list highlighted early-stage companies that were expected to compete effectively with more established companies. 

During the investigation, law enforcement agencies also recorded a notable operational success after cooperating with Meta and international authorities to dismantle nine cryptocurrency scam centers and arrest more than 275 individuals allegedly involved in fraudulent schemes targeting Americans. This marks a rare instance of coordinated action between the Department of Justice and China's Ministry of Public Security. 

A report alleging that workers employed by contractor Sama encountered explicit and sensitive footage while annotating video captured through Ray-Ban smart glasses prompted Meta to be subjected to renewed scrutiny for its privacy oversight. As a result of these allegations, Meta terminated its relationship with Sama shortly before terminating its agreement due to an unmet standard, a claim Sama denied publicly. 

Following the latest developments, the company issued a series of critical software updates to resolve vulnerabilities affecting Siri, the company's voice-based digital assistant, resulting in the potential for unauthorized access to sensitive user information on locked mobile devices. These updates further renewed attention to mobile device security. It was found that the assistant was capable of processing certain voice interactions even while the device was locked, allowing attackers who possessed iPhones or other Apple hardware to access contact information and additional private data without complete authentication if they had physical possession of the devices. 

As a result, Apple introduced security enhancements as a means of limiting Siri's functionality when devices are immobilized. By doing so, Apple reduces the likelihood that unauthorized commands may be executed while the device is immobilized as well as strengthening protections against physical access attacks. Several products within Apple's ecosystem, including iPhone, Apple Watch, iPadOS, and macOS Ventura systems, have been patched as part of broader platform security updates to mitigate the vulnerabilities.

Several software updates have been recommended to ensure that vulnerabilities are fully mitigated across all supported devices, including iOS 17.6 and iPadOS 17.6, by using the standard settings, general, and software update process. 

Collectively, these incidents reflect a rapidly evolving threat environment in which cybercrime, artificial intelligence, connected consumer technologies, and digital surveillance are becoming increasingly interconnected. This collection of cases illustrates how both attackers and law enforcement are leveraging the expanding data footprint created by modern devices and online services in order to infiltrate trusted app ecosystems with malicious cryptocurrency wallet campaigns as well as investigators using Bluetooth telemetry and cloud account records to investigate violent crimes. 

Furthermore, growing concerns surrounding the discovery of vulnerabilities using artificial intelligence, spyware-linked data exposure, biometric analysis, and voice assistant security continue to increase pressure for technology companies to strengthen platform security measures while maintaining a balance between privacy, accessibility, and operational transparency. 

Increasing sophistication and technical integration of cyber-enabled financial crime underscores the importance of proactive security updates, stricter application vetting, and enhanced awareness of consumers in increasingly interconnected digital ecosystems as cyber-enabled financial crime becomes more sophisticated and technologically integrated.
Read more »
website
Cyber Attacks DDOS Attack ransomware website

Ubuntu Services Remain Disrupted After DDoS Attack Targets Canonical Infrastructure

 



Several Ubuntu users reported problems installing updates and downloading packages after parts of Canonical’s infrastructure were disrupted during a Distributed Denial of Service (DDoS) attack. Canonical, the company behind the Ubuntu Linux distribution, confirmed that its online systems had been targeted.

In a statement released during the outage, Canonical said its web infrastructure was facing what it described as a sustained cross-border cyberattack and that teams were working to restore affected services. The company added that further updates would be shared through official channels once more information became available.

Discussions across Ubuntu community forums suggested that multiple services were affected during the incident, including Ubuntu’s security API and several Canonical-operated websites. Users also stated that software installations and system updates were temporarily unavailable or failing to complete properly.

Responsibility for the attack was later claimed by a group calling itself “The Islamic Cyber Resistance in Iraq 313 Team.” In Telegram posts attributed to the group, the attackers allegedly said they used a DDoS-for-hire platform known as “Beamed” to carry out the operation.

Beamed is described as a “booter” or “stresser” service, which are platforms that allow customers to pay for DDoS attacks. These services are often advertised as tools for testing website traffic capacity, although security researchers have repeatedly linked them to disruptive cyber operations. According to claims associated with the platform, Beamed is capable of generating attacks reaching 3.5 terabits per second, enough traffic to overwhelm major online infrastructure.

A DDoS attack works by flooding a server or network with enormous volumes of internet traffic from large numbers of connected devices at the same time. Once systems become overloaded, legitimate users may no longer be able to access websites, applications, or online services. Unlike ransomware campaigns or data breaches, the primary goal of most DDoS attacks is to interrupt availability rather than steal information directly.

To create these attack networks, threat actors typically compromise internet-connected devices using malware. Weak passwords, exposed systems, outdated software, and poorly secured smart devices are commonly targeted. Once infected, the devices become part of a botnet that can be remotely controlled through centralized management panels.

Access to these botnets is frequently sold through underground marketplaces and subscription-based services. Depending on the size and duration of the attack, prices can range from as little as $10 for lower-powered services to hundreds of dollars per month for larger and more persistent attacks.

The disruption drew attention within the open-source community because Ubuntu infrastructure is widely used across enterprise servers, development environments, cloud systems, and research institutions worldwide. Problems affecting package repositories or security update services can delay software deployments and patch management for organizations that rely on Ubuntu systems daily.

The incident also reflects how accessible DDoS-for-hire services have become over the past few years. Platforms offering attack infrastructure continue to reduce the technical barrier required to launch disruptive cyberattacks, allowing even low-skilled actors to rent large-scale attack capabilities for relatively small amounts of money.

Read more »
WebSocket Exploits
AI Agent Security AI Runtime Vulnerabilities Browser Session Hijacking Credential Theft Cyber Security OpenClaw Vulnerabilities Privilege Escalation Prompt Injection Attacks WebSocket Exploits

Critical OpenClaw Flaws Allow Persistent Access and Credential Abuse


 

OpenClaw, a self-hosted AI agent runtime which has gained rapid adoption by enterprises, introduces a new type of security exposure for enterprises as dynamically executed content, external skill integrations, and cloud-based authentication mechanisms are convergent without adequate defensive control mechanisms.

The OpenClaw platform is unlike conventional applications that are constructed using fixed execution logic, as it is capable of accepting untrusted inputs, retrieving and executing third-party code modules, and interacting with connected environments with assigned credentials, effectively extending the trust boundary far beyond the application layer itself. These architectural flexibility and the recently disclosed ClawJacked exploitation technique expose critical weaknesses in authentication handling and token protection within browser-based cloud development environments, according to security researchers. 

It has been demonstrated that malicious web content can exploit active developer sessions to extract sensitive access tokens, thereby granting attackers unauthorized access to source repositories, cloud infrastructures, and privileged enterprise resources. Increasingly, organizations are integrating cloud-native development platforms into their engineering workflows. This disclosure highlights concerns regarding privilege scoping, identity isolation, and other security aspects associated with autonomous AI-powered runtime environments.

A coordinated vulnerability chain, collectively known as the "Claw Chain," was identified by Cyera researchers in response to these concerns, demonstrating how multiple vulnerabilities within OpenClaw can be combined to compromise a system, gain unauthorized access to data, and escalate privileges across affected systems. 

In particular, two vulnerabilities have been assigned CVE-2026-44113 and CVE-2026-2026-44112, which contain time-of-check/time-of-use (TOCTOU) race conditions within the OpenShell managed sandbox backend, which could allow attackers to circumvent sandbox enforcement and interact with files outside of the mounted root. 

In contrast to the first issue, which permits arbitrary write operations which can lead to configuration changes, backdoor installations, and long-term control over compromised hosts, the second issue provides a pathway for unauthorized disclosure of system artifacts, credentials, and sensitive internal data through unauthorized file disclosure. 

Researchers also disclosed CVE-2026-44115, a vulnerability resulting from an incomplete denylist implementation that allows adversaries to conceal shell expansion tokens in heredoc payloads and execute commands that bypass runtime restrictions. 

A fourth vulnerability known as CVE-2026-44118 introduces an improper access control condition in which non-owner loopback clients can impersonate privileged users to manipulate gateway configurations, alter scheduled cron operations, and gain greater control of execution environments through unauthorized use of privileged accounts. These flaws collectively demonstrate the possibility of insufficient isolation, weak privilege boundaries, and inadequate runtime validation mechanisms within modern AI agent infrastructures resulting in a full compromise chain which can sustain stealthy and persistent access despite seemingly isolated weaknesses.

OpenClaw's rapid adoption and permissive architecture have contributed to its rapid transformation from a niche automation framework into a widely deployed AI-driven orchestration environment, further amplifying its security implications.

In late 2025, Austrian engineer Peter Steinberger released a public version of the project that gained wide traction because of its unique capability to provide custom automation capabilities outside of tightly controlled commercial ecosystems. The OpenClaw assistant does not rely on vendor-defined integrations, but rather allows users to develop, modify, and distribute executable "skills."

The result is a large repository containing thousands of automation scenarios developed by the community without centrally managing, categorizing, or validating their security. Due to its “self-hackability” design, where configurations, memory stores, and executable logic are maintained using local Markdown-based structures that can be modified by the user, it has attracted both developer interest and growing scrutiny from security researchers concerned about the absence of hardened trust boundaries. 

It was discovered that hundreds of OpenClaw administrative interfaces were accessible over the internet and did not require authentication. These concerns escalated. Investigations revealed that improperly configured reverse proxies could forward external traffic through localhost-trusted channels, causing the platform to mistakenly treat remote requests as privileged local connections. 

Security researcher Jamieson O'Reilly demonstrated the severity of the issue by gaining access to sensitive assets such as credentials for Anthropic APIs, Telegram bot tokens, Slack environments, and archived conversations. Further research revealed that prompt injection attacks could be used to manipulate the agent to perform unintended behavior by embedding malicious instructions in emails, files, or web content processed by the underlying large language model. 

One such scenario was demonstrated by Matvey Kukuy's delivery of crafted email payloads which coerced the bot to provide private cryptographic keys from the host environment upon receiving instructions to review inbox contents. Several independent experiments have demonstrated the system discloses confidential email data, exposes the contents of home directories via automated shell commands, and searches local storage automatically after receiving psychologically manipulative prompts. 

In aggregate, these incidents illustrate an industry concern that autonomous AI agents operating with wide filesystem visibility, persistent memory, and delegated execution privileges may be highly susceptible to indirect command manipulation when deployed in a manner that does not adhere to strict authentication controls, runtime isolation, and contextual validation controls.

Despite the fact that there is no publicly verified link to any known advanced persistent threat group linking the exploitation of the OpenClaw vulnerabilities, security analysts note that the operational characteristics of the attack are in line with tradecraft commonly utilized in credential theft, browser hijacking, and adversary-in-the-middle intrusion campaigns.

MITRE ATT&CK framework techniques, including T1185 related to browser session hijacking as well as T1557 related to man-in-the-middle attacks, have been identified as parallel techniques, and both of these techniques are frequently used in targeted attacks against enterprise authentication systems and cloud-based environments. There has been a growing concern that financially motivated threat actors and state-aligned operators may incorporate the technique into broader intrusion toolsets due to the availability of publicly available proof-of-concept exploit methods and the relatively low complexity required to weaponize these flaws. 

It was discovered that all versions of OpenClaw and Clawdbot before version 2026.2.2, including all builds up to version 2026.2.1, have been vulnerable to the vulnerability. Researchers stated that in the updated version, unauthorized WebSocket interactions are restricted and authentication checks are enforced on the exposed /cdp interface, which previously permitted unsafe assumptions regarding local trust. 

During the deployment of immediate patches, security teams are advised to monitor for suspicious localhost WebSocket activity, unauthorized browser extension behaviors, and attempts to communicate outbound via ws://127.0.0.1:17892/cdp or infrastructure controlled by known attackers. 

When rapid patching is an operational challenge, experts recommend that the OpenClaw browser extension be temporarily disabled, that host-level firewall restrictions be enforced around local WebSocket services, and that browser session telemetry and endpoint indicators of compromise be continuously reviewed to determine if there has been an unauthorized persistence of credentials or credential interception. 

OpenClaw's vulnerability chain is a reflection of an overall security reckoning taking place in the rapidly expanding AI agent ecosystem, in which convenience-driven automation is outpacing the maturation of defensive safeguards designed to contain it in a rapidly expanding ecosystem. There is an increasing tendency for autonomous assistants to gain access to developer environments, authentication tokens, local storage, messaging platforms, and cloud infrastructure, so that the traditional boundaries between trusted execution and untrusted input are being eroded. 

Platforms with the ability to self-modify, delegate command execution, and persist contextual memory present significant security risks that are fundamentally different from conventional software, particularly when deployed with excessive privileges and inadequate isolation during runtime. 

Despite the fact that OpenClaw's vulnerabilities may be mitigated by patching, access restrictions, and stronger authentication enforcement, the incident emphasizes the larger industry concern that artificial intelligence-driven operational tools may become a high value target for both cybercriminals and advanced intrusion groups in the very near future. 

These findings serve as a reminder that, as organizations adopt autonomous AI systems, security architecture, privilege segmentation, and continuous monitoring must no longer be overlooked.
Read more »
Shiny Gang
Canva Education Instructure Privacy Shiny Gang

Hacker Claims of Stealing Data from 8,809 Education Institutes, Instructure Hacked


A hacker has claimed to compromise edtech giant Instructure, saying it stole over 280 million records of students and staff from around 8,809 school, colleges, and online education platforms.

About Instructure

It is a cloud based edtech company famous for its Canvas LMS which is used by education institutes to handle academic work like grading, communications, and assignments.

About the hack

Recently, Instructure revealed that it was hacked; emails, users' names and private conversations were leaked.

ShinyHunters gang the alleged culprit

The ShinyHunters extortion gang claimed responsibility for the attack and says it stole 280 million records for students, teachers, and staff.

Academia suffered damage

The threat actors have now published a list of 8,809 school districts, universities, and educational platforms whose Canvas instances were allegedly impacted by the attack, sharing record counts per institution with BleepingComputers.

According to Bleeping Computers, “the record counts for each educational institution range from tens of thousands to several million per institution.”

Attack tactic

The hacker claims that the data was stolen through Canvas. Instructure has not replied to Bleeping Computers’ emails, but a few universities have started releasing statements regarding the matter. “BleepingComputer is not naming specific organizations listed by the threat actor, as we have not independently verified whether they were impacted by the breach,” it said.

Bleeping Computers added that the “threat actor claims the data was stolen using Canvas data export features, including DAP queries, provisioning reports, and user APIs, and that they harvested hundreds of gigabytes of user records, messages, and enrollment data.”

Universities have spoken up

The University of Colorado Boulder warned that, “CU is aware of a data breach involving Instructure, the parent company of Canvas, our learning management system. This reported data breach is a nationwide event affecting multiple institutions.” 

Whereas Rutgers said it was not “notified of any direct impact to our campus. Canvas remains available and operational to Rutgers faculty, staff, and students.” 

Tilburg University warned that “investigation is currently underway to determine what exactly happened and which systems were affected. It has not yet been confirmed whether data of Tilburg University students and staff has been impacted. Further questions have been submitted to the supplier to obtain more clarity”

Read more »
Subscribe to: Posts (Atom)

Featured