US Government Checks Canvas Company After Data Theft
US Government Checks Canvas Company After Data Theft
Introduction
The US government wants to talk to Instructure. This company owns Canvas. Hackers stole personal information from millions of people.
Main Body
Hackers attacked Canvas two times in May. They stole names and emails from students and teachers. Many schools had this problem. Instructure paid money to the hackers. The company says the hackers deleted the data. But experts say this is a bad idea. They say hackers often keep the data. Now, a government leader named Andrew Garbarino is asking questions. He wants to know why the company did not stop the hackers. He wants to know if the company followed the rules.
Conclusion
Canvas is working now. But the government is still checking the company and its mistakes.
Learning
⚡ The 'Action' Words (Past Tense)
In this story, everything happened in the past. To move to A2, you must see how words change to show something is finished.
The Pattern: Most words just add -ed at the end.
- Attack Attacked
- Pay Paid (This one is special!)
- Want Wanted (implied context)
Real Examples from the Text:
"Hackers attacked Canvas" "Instructure paid money"
📦 Grouping Things (Plurals)
Notice how the text talks about more than one person. Just add -s.
- Hacker Hackers
- School Schools
- Question Questions
Pro Tip: When you see an -s at the end of a noun, it means many, not one.
Vocabulary Learning
U.S. Congress Investigates Instructure After Repeated Cybersecurity Attacks
Introduction
The U.S. House Homeland Security Committee has asked Instructure, the company that owns the Canvas educational platform, to provide testimony. This request follows two separate cyberattacks that put the personal information of millions of users at risk.
Main Body
The security problems began on April 29, when a hacking group called ShinyHunters used a weakness in 'Free-For-Teacher' accounts to steal usernames, email addresses, and enrollment data. A second attack happened on May 7, where the hackers changed the appearance of login pages, forcing the platform into maintenance mode. The impact is significant, as the hackers claim to have targeted about 9,000 schools, which may have exposed the private data of many students. Instead of following the standard security advice from the FBI, Instructure paid the hackers to delete the stolen data. The company emphasized that this agreement worked because they received 'shred logs' as proof of deletion. However, security experts, such as Troy Hunt, have questioned if these logs are reliable. They argued that hackers often keep secret copies of data, pointing to a similar case with PowerSchool in 2024 where paying a ransom did not stop further attacks. Consequently, Representative Andrew Garbarino has started an investigation into whether Instructure worked effectively with the Cybersecurity and Infrastructure Security Agency (CISA). The committee is focusing on why the company failed to stop the hackers after the first attack and whether their overall response plan was sufficient. While Instructure has now disabled the problematic account types, the decision to pay the hackers remains a major point of debate.
Conclusion
Instructure's systems are now working normally, but the company is still being investigated by the government regarding its data protection failures and its choice to pay the ransom.
Learning
💡 The Power of "Whether"
At the A2 level, you probably use "if" for everything. Example: "I don't know if it is raining."
To reach B2, you need to master "whether." It is used when there are two clear, opposite possibilities (Yes or No / This or That). It makes your English sound more formal and precise, especially in professional or academic reports.
Look at the text:
"...an investigation into whether Instructure worked effectively..."
In this sentence, the government is asking: Did they work effectively? Yes or No? Using "whether" here shows a formal investigation of a choice or a fact.
🛠️ Leveling Up Your Vocabulary: Cause & Effect
Stop using "so" for every result. B2 speakers use connectors to link complex ideas. Look at this transition from the article:
Consequently This is a high-level way to say "Because of this / As a result."
A2 style: The company paid the hackers, so the government is investigating. B2 style: The company paid the hackers; consequently, the government has started an investigation.
🚩 Red Flag: The "False Security" of Simple Verbs
Notice how the text describes the problem. It doesn't just say "the hackers took data." It uses precise verbs:
- Exposed: To make something visible that should be hidden.
- Disabled: To turn something off so it cannot be used.
- Questioned: To express doubt about whether something is true.
Pro Tip: To move toward B2, replace general verbs (like get, take, put, do) with specific ones that describe the action more accurately.
Vocabulary Learning
Congressional Inquiry into Instructure's Response to Recurrent Cybersecurity Breaches
Introduction
The U.S. House Homeland Security Committee has requested testimony from Instructure, the parent company of the Canvas educational platform, following two distinct cyberattacks that compromised the personal data of millions of users.
Main Body
The security failures commenced on April 29, when the threat actor collective known as ShinyHunters exploited a vulnerability associated with 'Free-For-Teacher' accounts. This initial penetration facilitated the exfiltration of usernames, email addresses, course designations, and enrollment data. A subsequent breach occurred on May 7, during which the actors defaced login interfaces, necessitating a temporary transition of the platform into maintenance mode. The scale of the incident is substantial, with the perpetrators claiming to have targeted approximately 9,000 educational institutions, thereby potentially exposing the sensitive information of minors. In a departure from established cybersecurity protocols advocated by the FBI and industry specialists, Instructure entered into a financial agreement with ShinyHunters. The company asserts that this rapprochement ensured the deletion of stolen data, citing the receipt of 'shred logs' as verification. However, external analysts, including Troy Hunt, have questioned the validity of such logs, noting that the retention of clandestine copies is a common practice among ransomware collectives. This skepticism is reinforced by the precedent of the PowerSchool breach in 2024, where ransom payments failed to prevent subsequent extortion attempts. Consequently, Representative Andrew Garbarino, chair of the House Homeland Security Committee, has initiated an investigation into the adequacy of Instructure's coordination with the Cybersecurity and Infrastructure Security Agency (CISA). The committee's inquiry focuses on the company's failure to contain the threat actor after the primary intrusion and the systemic vulnerabilities inherent in the vendor's incident response capabilities. While Instructure has disabled the compromised account type and intends to conduct customer webinars, the institutional implications of its payment to the hackers remain a point of critical contention.
Conclusion
Instructure's systems are currently operational, though the company remains under legislative scrutiny regarding its data protection failures and its decision to pay a ransom.
Learning
The Architecture of Institutional Euphemism and Forensic Precision
To transition from B2 to C2, a student must move beyond 'correct' vocabulary and master Register Calibration. In this text, the bridge to C2 is found in the strategic use of Nominalization and Latinate Precision to describe chaotic events (cyberattacks) with sterile, administrative detachment.
◈ The 'Sterilization' Effect
Observe how the author avoids emotive or simplistic verbs in favor of high-level noun phrases. This is the hallmark of C2 academic and legal reporting:
- B2 approach: "The hackers stole data." C2 execution: "The exfiltration of usernames..."
- B2 approach: "The company tried to make a deal with the hackers." C2 execution: "...entered into a financial agreement... this rapprochement ensured..."
The word rapprochement is a masterstroke of register. Normally used in diplomacy to describe the restoration of friendly relations between nations, its application here to a ransomware negotiation is an example of ironic precision. It frames a desperate payment as a diplomatic maneuver, subtly highlighting the absurdity of the company's position.
◈ Lexical Nuance: The 'Skepticism' Spectrum
C2 mastery requires the ability to signal doubt without using basic adjectives like 'doubtful' or 'unlikely'.
"This skepticism is reinforced by the precedent of the PowerSchool breach..."
Here, the author utilizes The Precedent Logic. Instead of stating "this is probably a lie," the writer anchors the claim in a precedent (a prior legal or factual example). This shifts the argument from an opinion to a systemic analysis.
◈ Syntactic Density: The 'Causal Chain'
Note the construction: "...the systemic vulnerabilities inherent in the vendor's incident response capabilities."
This phrase contains four layers of modification:
- Systemic (Scale)
- Vulnerabilities (Core Subject)
- Inherent (Qualitative state)
- Incident response capabilities (Specific domain)
C2 Strategy: To replicate this, stop using relative clauses (e.g., "vulnerabilities that are part of the system") and start using adjectival clusters and compound nouns. This compresses information and increases the 'weight' of the prose, essential for legislative and high-level corporate discourse.