×
X Is Drowning in Disinformation Following US and Israel’s Attack on Iran

X Is Drowning in Disinformation Following US and Israel’s Attack on Iran

Minutes after Donald Trump announced that the US and Israeli governments had launched a “major combat operation” against Iran in the early hours of Saturday morning, disinformation about the attack and Tehran’s response flooded X.

WIRED has reviewed hundreds of posts on X, some of which have racked up millions of views, that promote misleading claims about the locations and scale of the attack.

Elon Musk’s social media platform is a verifiable mess: In some cases, alleged video footage of the attack shared in posts on X are actually months or years old. In several posts, video footage of apparent attacks have been attributed to incorrect locations. A number of images shared on X appear to be altered or generated with AI. Other posts attempt to pass off video game footage as scenes from the conflict.

X did not respond to a request for comment. Under Musk’s stewardship, X has become a haven for disinformation, especially during major global breaking news events. At the beginning of the Israel-Hamas war, and more recently during anti-immigration enforcement protests in LA, the platform has drowned in inaccurate and faulty posts.

Almost all of the most viral posts reviewed by WIRED on Saturday came from accounts with blue check marks, meaning they pay X for its premium service and could be eligible to earn money based on how much engagement their posts generate, even if the content is false. While some posts with disinformation have a community note appended beneath them to correct the record, they remain up on the site, and it’s unclear how many people viewed them before the notes appeared.

One video posted by a blue check mark account claimed to show ballistic missiles over Dubai; the clip actually showed Iranian ballistic missiles fired at Tel Aviv in October 2024. The post has been viewed over 4.4 million times.

One of the most viral clips shared on X in the hours after the attack claims to show an Israeli fighter jet being shot down by Iranian air defense systems. The video has been shared by dozens of accounts, including one post which has been viewed more than 3.5 million times. The provenance of the video is unclear, but there have been no credible reports of any Israeli jets being shot down over Iran on Saturday.

Another account that claims to be an expert in open source intelligence posted a video showing explosions, alongside the caption: “6 Iranian Hypersonic Missiles hit the Indian-invested Israeli Haifa port. Massive damages reported.” The video has been viewed 64,000 times, but the footage was actually captured last July and shows an Israeli attack on the defense ministry in Damascus, Syria.

In a number of cases, pro-Iranian accounts have been using images and footage from Saturday’s attacks to falsely claim successful strikes against Israel. “IRANIAN MISSILE IMPACT IN TEL AVIV RIGHT NOW,” the Iran Observer account wrote in a post featuring an image of Dubai. The post had been viewed over 200,000 times before it was deleted, but dozens of other posts sharing the same image and making the same claims remain on X.

Tehran Times, a news outlet aligned with the Iranian government, posted what appears to be an AI-generated image on X which claims to show that “an American radar in Qatar was completely destroyed today in an Iranian drone strike.” The use of AI generated images was flagged on X by Tal Hagin, a senior analyst with open source intelligence company Golden Owl. While there are reports that drone and missile attacks targeted the US Navy’s 5th Fleet headquarters in Bahrain, there are no reports yet of similar successful attacks in Qatar.

A pro-Trump account, which also features a blue check mark, posted images claiming to show the before and after pictures of the palace of Iranian Supreme Leader Ali Khamenei, which was targeted during Saturday’s missile attacks. (In a post on Truth Social, Trump claimed Khamenei was killed in an attack.) While the after picture appears to accurately show the palace after the attack, the before picture shows the Mausoleum of Ruhollah Khomeini, which is located on the other side of Tehran. The post has been viewed 365,000 times.

Source link
#Drowning #Disinformation #Israels #Attack #Iran


French prosecutors who are investigating Elon Musk and his social media platform X have summoned the billionaire to France to face preliminary charges. The investigation is now officially a criminal probe, according to French officials.

France opened a probe in 2025 to investigate whether X has violated French law, an investigation that has expanded following incidents last year when Musk’s AI chatbot Grok started denying the Holocaust, praising Hitler, and allegedly generating child sexual abuse material when prompted by users.

According to the Wall Street Journal, Musk and former CEO Linda Yaccarino have been asked to travel to France to face preliminary charges. As the Journal explains, after preliminary charges have been filed in France, an investigating magistrate starts a process that can take months and doesn’t necessarily mean a trial will be held. It’s entirely possible that the case could ultimately be dropped.

French authorities are looking into the “complicity” of Musk in creating sexual abuse images of minors and sexually explicit deepfakes, according to the Associated Press. Grok also allegedly spread misinformation in French, including a claim that Auschwitz wasn’t a death camp during the Holocaust but was used for “disinfection with Zyklon B against typhus.”

Musk purchased Twitter in late 2022 and changed the name to X. The billionaire made many changes to the platform, stripping away safeguards that allowed people to know when an account was verified, and inviting back far-right figures who had previously been banned. Musk welcomed users like white supremacist Nick Fuentes and conspiracy theorist Alex Jones, among a host of others.

Musk also tinkered with the site in ways that turned it into a hotbed of far-right extremism and pro-Trump propaganda in the lead-up to the 2024 presidential election. Musk donated over $290 million to Republicans in the 2024 cycle and even ran a program that paid some voters in swing states up to $1 million to sign a “petition,” a move that was just very clearly an attempt at paying people to vote for Trump.

Musk, who is currently worth $803 billion, was rewarded with a job overseeing the dismantling of agencies in the federal government under the auspices of DOGE, the Department of Government Efficiency. Ultimately, about 300,000 government workers lost their jobs, and USAID was unlawfully dissolved. The cuts to global aid are estimated to lead to 23 million deaths by the year 2030, according to an analysis by The Lancet Global Health.

Last month, the U.S. Department of Justice told French authorities the U.S. wouldn’t assist in any investigation of Musk and X, something that wasn’t a surprise given the billionaire oligarch’s ties to the Trump regime.

“This investigation seeks to use the criminal legal system in France to regulate a public square for the free expression of ideas and opinions in a manner contrary to the First Amendment of the United States Constitution,” the April letter said, according to the Wall Street Journal.

X didn’t immediately respond to questions emailed Thursday about whether Musk planned on traveling to France. Gizmodo will update this article if we hear back.

#French #Prosecutors #Elon #Musk #Linda #Yaccarino #Face #Preliminary #ChargesElon Musk,Grok">French Prosecutors Want Elon Musk and Linda Yaccarino to Face Preliminary Charges
                French prosecutors who are investigating Elon Musk and his social media platform X have summoned the billionaire to France to face preliminary charges. The investigation is now officially a criminal probe, according to French officials. France opened a probe in 2025 to investigate whether X has violated French law, an investigation that has expanded following incidents last year when Musk’s AI chatbot Grok started denying the Holocaust, praising Hitler, and allegedly generating child sexual abuse material when prompted by users. According to the Wall Street Journal, Musk and former CEO Linda Yaccarino have been asked to travel to France to face preliminary charges. As the Journal explains, after preliminary charges have been filed in France, an investigating magistrate starts a process that can take months and doesn’t necessarily mean a trial will be held. It’s entirely possible that the case could ultimately be dropped.

 French authorities are looking into the “complicity” of Musk in creating sexual abuse images of minors and sexually explicit deepfakes, according to the Associated Press. Grok also allegedly spread misinformation in French, including a claim that Auschwitz wasn’t a death camp during the Holocaust but was used for “disinfection with Zyklon B against typhus.” Musk purchased Twitter in late 2022 and changed the name to X. The billionaire made many changes to the platform, stripping away safeguards that allowed people to know when an account was verified, and inviting back far-right figures who had previously been banned. Musk welcomed users like white supremacist Nick Fuentes and conspiracy theorist Alex Jones, among a host of others.

 Musk also tinkered with the site in ways that turned it into a hotbed of far-right extremism and pro-Trump propaganda in the lead-up to the 2024 presidential election. Musk donated over 0 million to Republicans in the 2024 cycle and even ran a program that paid some voters in swing states up to  million to sign a “petition,” a move that was just very clearly an attempt at paying people to vote for Trump.

 Musk, who is currently worth 3 billion, was rewarded with a job overseeing the dismantling of agencies in the federal government under the auspices of DOGE, the Department of Government Efficiency. Ultimately, about 300,000 government workers lost their jobs, and USAID was unlawfully dissolved. The cuts to global aid are estimated to lead to 23 million deaths by the year 2030, according to an analysis by The Lancet Global Health. Last month, the U.S. Department of Justice told French authorities the U.S. wouldn’t assist in any investigation of Musk and X, something that wasn’t a surprise given the billionaire oligarch’s ties to the Trump regime.

 “This investigation seeks to use the criminal legal system in France to regulate a public square for the free expression of ideas and opinions in a manner contrary to the First Amendment of the United States Constitution,” the April letter said, according to the Wall Street Journal. X didn’t immediately respond to questions emailed Thursday about whether Musk planned on traveling to France. Gizmodo will update this article if we hear back.      #French #Prosecutors #Elon #Musk #Linda #Yaccarino #Face #Preliminary #ChargesElon Musk,Grok

Wall Street Journal, Musk and former CEO Linda Yaccarino have been asked to travel to France to face preliminary charges. As the Journal explains, after preliminary charges have been filed in France, an investigating magistrate starts a process that can take months and doesn’t necessarily mean a trial will be held. It’s entirely possible that the case could ultimately be dropped.

French authorities are looking into the “complicity” of Musk in creating sexual abuse images of minors and sexually explicit deepfakes, according to the Associated Press. Grok also allegedly spread misinformation in French, including a claim that Auschwitz wasn’t a death camp during the Holocaust but was used for “disinfection with Zyklon B against typhus.”

Musk purchased Twitter in late 2022 and changed the name to X. The billionaire made many changes to the platform, stripping away safeguards that allowed people to know when an account was verified, and inviting back far-right figures who had previously been banned. Musk welcomed users like white supremacist Nick Fuentes and conspiracy theorist Alex Jones, among a host of others.

Musk also tinkered with the site in ways that turned it into a hotbed of far-right extremism and pro-Trump propaganda in the lead-up to the 2024 presidential election. Musk donated over $290 million to Republicans in the 2024 cycle and even ran a program that paid some voters in swing states up to $1 million to sign a “petition,” a move that was just very clearly an attempt at paying people to vote for Trump.

Musk, who is currently worth $803 billion, was rewarded with a job overseeing the dismantling of agencies in the federal government under the auspices of DOGE, the Department of Government Efficiency. Ultimately, about 300,000 government workers lost their jobs, and USAID was unlawfully dissolved. The cuts to global aid are estimated to lead to 23 million deaths by the year 2030, according to an analysis by The Lancet Global Health.

Last month, the U.S. Department of Justice told French authorities the U.S. wouldn’t assist in any investigation of Musk and X, something that wasn’t a surprise given the billionaire oligarch’s ties to the Trump regime.

“This investigation seeks to use the criminal legal system in France to regulate a public square for the free expression of ideas and opinions in a manner contrary to the First Amendment of the United States Constitution,” the April letter said, according to the Wall Street Journal.

X didn’t immediately respond to questions emailed Thursday about whether Musk planned on traveling to France. Gizmodo will update this article if we hear back.

#French #Prosecutors #Elon #Musk #Linda #Yaccarino #Face #Preliminary #ChargesElon Musk,Grok">French Prosecutors Want Elon Musk and Linda Yaccarino to Face Preliminary ChargesFrench Prosecutors Want Elon Musk and Linda Yaccarino to Face Preliminary Charges
                French prosecutors who are investigating Elon Musk and his social media platform X have summoned the billionaire to France to face preliminary charges. The investigation is now officially a criminal probe, according to French officials. France opened a probe in 2025 to investigate whether X has violated French law, an investigation that has expanded following incidents last year when Musk’s AI chatbot Grok started denying the Holocaust, praising Hitler, and allegedly generating child sexual abuse material when prompted by users. According to the Wall Street Journal, Musk and former CEO Linda Yaccarino have been asked to travel to France to face preliminary charges. As the Journal explains, after preliminary charges have been filed in France, an investigating magistrate starts a process that can take months and doesn’t necessarily mean a trial will be held. It’s entirely possible that the case could ultimately be dropped.

 French authorities are looking into the “complicity” of Musk in creating sexual abuse images of minors and sexually explicit deepfakes, according to the Associated Press. Grok also allegedly spread misinformation in French, including a claim that Auschwitz wasn’t a death camp during the Holocaust but was used for “disinfection with Zyklon B against typhus.” Musk purchased Twitter in late 2022 and changed the name to X. The billionaire made many changes to the platform, stripping away safeguards that allowed people to know when an account was verified, and inviting back far-right figures who had previously been banned. Musk welcomed users like white supremacist Nick Fuentes and conspiracy theorist Alex Jones, among a host of others.

 Musk also tinkered with the site in ways that turned it into a hotbed of far-right extremism and pro-Trump propaganda in the lead-up to the 2024 presidential election. Musk donated over $290 million to Republicans in the 2024 cycle and even ran a program that paid some voters in swing states up to $1 million to sign a “petition,” a move that was just very clearly an attempt at paying people to vote for Trump.

 Musk, who is currently worth $803 billion, was rewarded with a job overseeing the dismantling of agencies in the federal government under the auspices of DOGE, the Department of Government Efficiency. Ultimately, about 300,000 government workers lost their jobs, and USAID was unlawfully dissolved. The cuts to global aid are estimated to lead to 23 million deaths by the year 2030, according to an analysis by The Lancet Global Health. Last month, the U.S. Department of Justice told French authorities the U.S. wouldn’t assist in any investigation of Musk and X, something that wasn’t a surprise given the billionaire oligarch’s ties to the Trump regime.

 “This investigation seeks to use the criminal legal system in France to regulate a public square for the free expression of ideas and opinions in a manner contrary to the First Amendment of the United States Constitution,” the April letter said, according to the Wall Street Journal. X didn’t immediately respond to questions emailed Thursday about whether Musk planned on traveling to France. Gizmodo will update this article if we hear back.      #French #Prosecutors #Elon #Musk #Linda #Yaccarino #Face #Preliminary #ChargesElon Musk,Grok

French prosecutors who are investigating Elon Musk and his social media platform X have summoned the billionaire to France to face preliminary charges. The investigation is now officially a criminal probe, according to French officials.

France opened a probe in 2025 to investigate whether X has violated French law, an investigation that has expanded following incidents last year when Musk’s AI chatbot Grok started denying the Holocaust, praising Hitler, and allegedly generating child sexual abuse material when prompted by users.

According to the Wall Street Journal, Musk and former CEO Linda Yaccarino have been asked to travel to France to face preliminary charges. As the Journal explains, after preliminary charges have been filed in France, an investigating magistrate starts a process that can take months and doesn’t necessarily mean a trial will be held. It’s entirely possible that the case could ultimately be dropped.

French authorities are looking into the “complicity” of Musk in creating sexual abuse images of minors and sexually explicit deepfakes, according to the Associated Press. Grok also allegedly spread misinformation in French, including a claim that Auschwitz wasn’t a death camp during the Holocaust but was used for “disinfection with Zyklon B against typhus.”

Musk purchased Twitter in late 2022 and changed the name to X. The billionaire made many changes to the platform, stripping away safeguards that allowed people to know when an account was verified, and inviting back far-right figures who had previously been banned. Musk welcomed users like white supremacist Nick Fuentes and conspiracy theorist Alex Jones, among a host of others.

Musk also tinkered with the site in ways that turned it into a hotbed of far-right extremism and pro-Trump propaganda in the lead-up to the 2024 presidential election. Musk donated over $290 million to Republicans in the 2024 cycle and even ran a program that paid some voters in swing states up to $1 million to sign a “petition,” a move that was just very clearly an attempt at paying people to vote for Trump.

Musk, who is currently worth $803 billion, was rewarded with a job overseeing the dismantling of agencies in the federal government under the auspices of DOGE, the Department of Government Efficiency. Ultimately, about 300,000 government workers lost their jobs, and USAID was unlawfully dissolved. The cuts to global aid are estimated to lead to 23 million deaths by the year 2030, according to an analysis by The Lancet Global Health.

Last month, the U.S. Department of Justice told French authorities the U.S. wouldn’t assist in any investigation of Musk and X, something that wasn’t a surprise given the billionaire oligarch’s ties to the Trump regime.

“This investigation seeks to use the criminal legal system in France to regulate a public square for the free expression of ideas and opinions in a manner contrary to the First Amendment of the United States Constitution,” the April letter said, according to the Wall Street Journal.

X didn’t immediately respond to questions emailed Thursday about whether Musk planned on traveling to France. Gizmodo will update this article if we hear back.

#French #Prosecutors #Elon #Musk #Linda #Yaccarino #Face #Preliminary #ChargesElon Musk,Grok

ransomware gangs and data extortion attacks. But never before, perhaps, has a cyberattack against a single software platform so thoroughly disrupted the daily operations of thousands of schools across the United States.

The widely used digital learning platform Canvas was put into “maintenance mode” on Thursday after its maker, the education tech giant Instructure, suffered a data breach and faced an extortion attempt by attackers using the recognizable moniker “ShinyHunters.” Though the hackers have been advertising the breach and attempting to extract a ransom payment from Instructure since May 1, the situation took on additional immediacy for regular people across the US and beyond on Thursday because the Canvas downtime caused chaos at schools, including those in the midst of finals and end-of-year assignments.

Universities like Harvard, Columbia, Rutgers, and Georgetown sent alerts to students about the situation in recent days; other institutions, including school districts in at least a dozen states, also appear to have been affected. In a list published by the hackers behind the attack on their ransom-focused dark web site, they claim the breach affected more than 8,800 schools. The exact scale and reach of the breach is currently unclear, though. And the fact that Canvas was down throughout Thursday afternoon and evening further complicated the picture.

In a running incident update log that began on May 1, Steve Proud, Instructure’s chief information security officer, said that the company had “recently experienced a cybersecurity incident perpetrated by a criminal threat actor.” He added on May 2 that “the information involved” for “users at affected institutions” included names, email addresses, student ID numbers, and messages exchanged by users on the platform.

The situation was ultimately marked as “Resolved” on Wednesday, with Proud writing that “Canvas is fully operational, and we are not seeing any ongoing unauthorized activity.” At midday on Thursday, though, the Instructure status page registered an “issue” where “some users are having difficulties logging into Student ePortfolios.” Within a few hours, the company had added another status update: “Instructure has placed Canvas, Canvas Beta and Canvas Test in maintenance mode.” Late Thursday evening, the company said that Canvas was available again “for most users.”

TechCrunch reported on Thursday that the hackers launched a secondary wave of attacks, defacing some schools’ Canvas portals by injecting an HTML file to display their own message on the schools’ Canvas login pages. According to The Harvard Crimson, attackers modified the Harvard Canvas login page to show a message that included a list of schools that the hackers claim were impacted by the breach.

The message from attackers “urged schools included on the affected list to consult with a cyber advisory firm and contact the group privately to negotiate a settlement before the end of the day on May 12—or else risk their data being leaked,” The Crimson reported. “It is unclear what information tied to Harvard affiliates was included in the alleged breach.”

Instructure did not immediately respond to a request for comment about Thursday’s outages and how they fit into the bigger picture of the breach. But the situation is significant given that a massive trove of student information has potentially been exposed, and the visibility of the incident across the country makes it a key example of a longstanding, yet endlessly escalating problem of data extortion and ransomware attacks.

The ShinyHunters name is associated with massive data dumps and has been linked to the infamous hacker collective known as the Com. But as the constellation of actors has shifted over the years, numerous attackers have taken up the most prominent Com-related monikers. A number of recent attacks have invoked other names, such as Lapsus$, with little or no connection to the original group that operated under the name.

#Canvas #Hack #Kind #Ransomware #Debacleransomware,cybersecurity,malware,hacks,hacking,security,vulnerabilities">The Canvas Hack Is a New Kind of Ransomware DebacleHigher education has long been a target of ransomware gangs and data extortion attacks. But never before, perhaps, has a cyberattack against a single software platform so thoroughly disrupted the daily operations of thousands of schools across the United States.The widely used digital learning platform Canvas was put into “maintenance mode” on Thursday after its maker, the education tech giant Instructure, suffered a data breach and faced an extortion attempt by attackers using the recognizable moniker “ShinyHunters.” Though the hackers have been advertising the breach and attempting to extract a ransom payment from Instructure since May 1, the situation took on additional immediacy for regular people across the US and beyond on Thursday because the Canvas downtime caused chaos at schools, including those in the midst of finals and end-of-year assignments.Universities like Harvard, Columbia, Rutgers, and Georgetown sent alerts to students about the situation in recent days; other institutions, including school districts in at least a dozen states, also appear to have been affected. In a list published by the hackers behind the attack on their ransom-focused dark web site, they claim the breach affected more than 8,800 schools. The exact scale and reach of the breach is currently unclear, though. And the fact that Canvas was down throughout Thursday afternoon and evening further complicated the picture.In a running incident update log that began on May 1, Steve Proud, Instructure’s chief information security officer, said that the company had “recently experienced a cybersecurity incident perpetrated by a criminal threat actor.” He added on May 2 that “the information involved” for “users at affected institutions” included names, email addresses, student ID numbers, and messages exchanged by users on the platform.The situation was ultimately marked as “Resolved” on Wednesday, with Proud writing that “Canvas is fully operational, and we are not seeing any ongoing unauthorized activity.” At midday on Thursday, though, the Instructure status page registered an “issue” where “some users are having difficulties logging into Student ePortfolios.” Within a few hours, the company had added another status update: “Instructure has placed Canvas, Canvas Beta and Canvas Test in maintenance mode.” Late Thursday evening, the company said that Canvas was available again “for most users.”TechCrunch reported on Thursday that the hackers launched a secondary wave of attacks, defacing some schools’ Canvas portals by injecting an HTML file to display their own message on the schools’ Canvas login pages. According to The Harvard Crimson, attackers modified the Harvard Canvas login page to show a message that included a list of schools that the hackers claim were impacted by the breach.The message from attackers “urged schools included on the affected list to consult with a cyber advisory firm and contact the group privately to negotiate a settlement before the end of the day on May 12—or else risk their data being leaked,” The Crimson reported. “It is unclear what information tied to Harvard affiliates was included in the alleged breach.”Instructure did not immediately respond to a request for comment about Thursday’s outages and how they fit into the bigger picture of the breach. But the situation is significant given that a massive trove of student information has potentially been exposed, and the visibility of the incident across the country makes it a key example of a longstanding, yet endlessly escalating problem of data extortion and ransomware attacks.The ShinyHunters name is associated with massive data dumps and has been linked to the infamous hacker collective known as the Com. But as the constellation of actors has shifted over the years, numerous attackers have taken up the most prominent Com-related monikers. A number of recent attacks have invoked other names, such as Lapsus$, with little or no connection to the original group that operated under the name.#Canvas #Hack #Kind #Ransomware #Debacleransomware,cybersecurity,malware,hacks,hacking,security,vulnerabilities

gangs and data extortion attacks. But never before, perhaps, has a cyberattack against a single software platform so thoroughly disrupted the daily operations of thousands of schools across the United States.

The widely used digital learning platform Canvas was put into “maintenance mode” on Thursday after its maker, the education tech giant Instructure, suffered a data breach and faced an extortion attempt by attackers using the recognizable moniker “ShinyHunters.” Though the hackers have been advertising the breach and attempting to extract a ransom payment from Instructure since May 1, the situation took on additional immediacy for regular people across the US and beyond on Thursday because the Canvas downtime caused chaos at schools, including those in the midst of finals and end-of-year assignments.

Universities like Harvard, Columbia, Rutgers, and Georgetown sent alerts to students about the situation in recent days; other institutions, including school districts in at least a dozen states, also appear to have been affected. In a list published by the hackers behind the attack on their ransom-focused dark web site, they claim the breach affected more than 8,800 schools. The exact scale and reach of the breach is currently unclear, though. And the fact that Canvas was down throughout Thursday afternoon and evening further complicated the picture.

In a running incident update log that began on May 1, Steve Proud, Instructure’s chief information security officer, said that the company had “recently experienced a cybersecurity incident perpetrated by a criminal threat actor.” He added on May 2 that “the information involved” for “users at affected institutions” included names, email addresses, student ID numbers, and messages exchanged by users on the platform.

The situation was ultimately marked as “Resolved” on Wednesday, with Proud writing that “Canvas is fully operational, and we are not seeing any ongoing unauthorized activity.” At midday on Thursday, though, the Instructure status page registered an “issue” where “some users are having difficulties logging into Student ePortfolios.” Within a few hours, the company had added another status update: “Instructure has placed Canvas, Canvas Beta and Canvas Test in maintenance mode.” Late Thursday evening, the company said that Canvas was available again “for most users.”

TechCrunch reported on Thursday that the hackers launched a secondary wave of attacks, defacing some schools’ Canvas portals by injecting an HTML file to display their own message on the schools’ Canvas login pages. According to The Harvard Crimson, attackers modified the Harvard Canvas login page to show a message that included a list of schools that the hackers claim were impacted by the breach.

The message from attackers “urged schools included on the affected list to consult with a cyber advisory firm and contact the group privately to negotiate a settlement before the end of the day on May 12—or else risk their data being leaked,” The Crimson reported. “It is unclear what information tied to Harvard affiliates was included in the alleged breach.”

Instructure did not immediately respond to a request for comment about Thursday’s outages and how they fit into the bigger picture of the breach. But the situation is significant given that a massive trove of student information has potentially been exposed, and the visibility of the incident across the country makes it a key example of a longstanding, yet endlessly escalating problem of data extortion and ransomware attacks.

The ShinyHunters name is associated with massive data dumps and has been linked to the infamous hacker collective known as the Com. But as the constellation of actors has shifted over the years, numerous attackers have taken up the most prominent Com-related monikers. A number of recent attacks have invoked other names, such as Lapsus$, with little or no connection to the original group that operated under the name.

#Canvas #Hack #Kind #Ransomware #Debacleransomware,cybersecurity,malware,hacks,hacking,security,vulnerabilities">The Canvas Hack Is a New Kind of Ransomware Debacle

Higher education has long been a target of ransomware gangs and data extortion attacks. But never before, perhaps, has a cyberattack against a single software platform so thoroughly disrupted the daily operations of thousands of schools across the United States.

The widely used digital learning platform Canvas was put into “maintenance mode” on Thursday after its maker, the education tech giant Instructure, suffered a data breach and faced an extortion attempt by attackers using the recognizable moniker “ShinyHunters.” Though the hackers have been advertising the breach and attempting to extract a ransom payment from Instructure since May 1, the situation took on additional immediacy for regular people across the US and beyond on Thursday because the Canvas downtime caused chaos at schools, including those in the midst of finals and end-of-year assignments.

Universities like Harvard, Columbia, Rutgers, and Georgetown sent alerts to students about the situation in recent days; other institutions, including school districts in at least a dozen states, also appear to have been affected. In a list published by the hackers behind the attack on their ransom-focused dark web site, they claim the breach affected more than 8,800 schools. The exact scale and reach of the breach is currently unclear, though. And the fact that Canvas was down throughout Thursday afternoon and evening further complicated the picture.

In a running incident update log that began on May 1, Steve Proud, Instructure’s chief information security officer, said that the company had “recently experienced a cybersecurity incident perpetrated by a criminal threat actor.” He added on May 2 that “the information involved” for “users at affected institutions” included names, email addresses, student ID numbers, and messages exchanged by users on the platform.

The situation was ultimately marked as “Resolved” on Wednesday, with Proud writing that “Canvas is fully operational, and we are not seeing any ongoing unauthorized activity.” At midday on Thursday, though, the Instructure status page registered an “issue” where “some users are having difficulties logging into Student ePortfolios.” Within a few hours, the company had added another status update: “Instructure has placed Canvas, Canvas Beta and Canvas Test in maintenance mode.” Late Thursday evening, the company said that Canvas was available again “for most users.”

TechCrunch reported on Thursday that the hackers launched a secondary wave of attacks, defacing some schools’ Canvas portals by injecting an HTML file to display their own message on the schools’ Canvas login pages. According to The Harvard Crimson, attackers modified the Harvard Canvas login page to show a message that included a list of schools that the hackers claim were impacted by the breach.

The message from attackers “urged schools included on the affected list to consult with a cyber advisory firm and contact the group privately to negotiate a settlement before the end of the day on May 12—or else risk their data being leaked,” The Crimson reported. “It is unclear what information tied to Harvard affiliates was included in the alleged breach.”

Instructure did not immediately respond to a request for comment about Thursday’s outages and how they fit into the bigger picture of the breach. But the situation is significant given that a massive trove of student information has potentially been exposed, and the visibility of the incident across the country makes it a key example of a longstanding, yet endlessly escalating problem of data extortion and ransomware attacks.

The ShinyHunters name is associated with massive data dumps and has been linked to the infamous hacker collective known as the Com. But as the constellation of actors has shifted over the years, numerous attackers have taken up the most prominent Com-related monikers. A number of recent attacks have invoked other names, such as Lapsus$, with little or no connection to the original group that operated under the name.

#Canvas #Hack #Kind #Ransomware #Debacleransomware,cybersecurity,malware,hacks,hacking,security,vulnerabilities

Post Comment