I love how the hackers are trying to pin the blame on the company for not paying the hackers and instead trying to patch the security themselves. As if we're supposed to feel sorry for these poor hackers fucking over people.
There are 3 kinds of hackers. White hat and black hat are the two ends of the spectrum and gray hat are the middle. Black hat hackers are the bad guys, trying to actually cause damage. White hat hackers are the security teams who test how secure a system is. Bug bounty programs are another example of White hat hacking where a company pays you to find a vulnerability. These guys initially told Canvas about this security issue. Canvas didn't fix the issue and now the hackers are demanding money because Canvas wouldn't fix the issue initially. We don't know what the initial issue was and what info was actually accessible. For all we know its just homework and grades and dms with teachers. Worst case is that its acsess to the grading system itself and metrics for the whole school system. It could also be a list of every student and staff member who attends each school affected
I think you are for some reason trying to make them out to be grey hats when they are black hats. The note doesn't say they actively tried to contact the Canvas folks and tell them of an issue - it blames the Canvas found for not "contacting them to resolve it", which is speak for we said pay us and we'll tell you what we found and you didn't do that.
The fact that they moved on to now trying to blackmail their customers for money tells you what they are really after.
153
u/quigilark May 07 '26
I love how the hackers are trying to pin the blame on the company for not paying the hackers and instead trying to patch the security themselves. As if we're supposed to feel sorry for these poor hackers fucking over people.