Cybersecurity Lessons from the Canvas Data Breach

The Shared Security Podcast dives into the recent Canvas data breach involving cybercriminal group Shiny Hunters, revealing a controversial settlement where Instructure reportedly paid ransom without confirming it. Despite the company's claim that stolen data was returned and destroyed, the lack of transparency—especially the absence of a public incident disclosure and the delayed release of an incident dashboard—has sparked widespread criticism. Guest Kevin Tackett argues that while no organization can fully prevent breaches, especially when targeted by sophisticated groups like Shiny Hunters, the true failure lies in post-incident response. He emphasizes that organizations must prioritize testing their incident response plans, disaster recovery, and communication strategies—not just technical defenses. The episode reframes the conversation from 'did they get hacked?' to 'how did they respond?' and warns that poor crisis communication can be more damaging than the breach itself. Tackett stresses that ransom payments, while morally and strategically contentious, are often a business decision driven by necessity, not weakness. He draws a parallel to NFTs—digital proof of ownership that can't be verified—highlighting the trust issues in digital promises. The takeaway is clear: organizations should invest in proactive preparedness, not just reactive security.