3 ms·

There’s a similar dynamic from within the hacker group itself. For the ransom group, it is better for them to be perceived as trustworthy. Pay the ransom and we

There’s a similar dynamic from within the hacker group itself. For the ransom group, it is better for them to be perceived as trustworthy. Pay the ransom and we won’t leak your data. For any individual within the ransom group, they can get a big payout by selling the data.

MagicMoonlight 5mo ago
I don’t know if that’s really true. Nobody would really give a shit if you leaked where everyone goes to college… because it’s already on their LinkedIn or whatever. The only people it’s valuable for is the ransomee, because they don’t want the reputational hit of having their data everywhere.
- HDBaseT 5mo ago
  It really isn't as simple as that. You are leaking email addresses that likely otherwise wouldn't be out there publicly. Whilst email addresses and names are "effectively" public, they aren't just in a one big database anyone on the planet can access. Every single one of those email addresses will receive increased spam and phishing attempts, with more isolated information (such as School, First+Last Name, Subjects, Teachers/Lecturers, etc) the phishing attempts can be more refined. i.e, Student receives an email that looks like its from their school (has email footer, has student name, has relevant teacher name, subject name, etc), the user is now more likely to click some sketchy link. These little identifiers add up, especially when cross-references with other leaks. Even more problematic when most of the users wrapped up in a leak like this are under 18 too. A lot of this stuff could be done previously, although the effort and scale to do so would of been higher/harder.
SoftTalker 5mo ago
Depends on what they actually got. Names and email addresses? Considered public and are not so valuable. Universities usually publish those in a directory anyway. Messages between students and instructors? Likely pretty boring, but possibly embarassing or confidential for a given individual. Grades? Could be a FERPA violation. Critical PII such as SSNs? Probably not in the LMS to begin with.
- browsingonly 5mo ago
  SSNs have been used as student IDs by particularly stupid educational institutions. The 'nice' thing about getting SSNs from students is the likelihood they'll live for a long time after the breach and thus be subject to identity theft for many years to come.
  - SoftTalker 5mo ago
    This was common years (decades, really) ago but I'd be surprised if any university today was still doing that. I guess there could still be some....
  - kelnos 5mo ago
    My university stopped putting SSNs on student IDs more than 25 years ago. I'd be surprised if there are many who still do that. Though I wouldn't be surprised if some 40 year old university IT system requires its use as an identifier, regardless of whether or not it gets printed anywhere.
- Mezzie 5mo ago
  I just spoke with a K-12 teacher I know, and she confirmed SSNs in the Canvas instance. Yikes.
  - saghm 5mo ago
    Wow. A lot of K-12 students probably don't even know their own SSN off the top of their head, much less understand the impact of having it stored in this way. I can't fathom why it would be necessary for the SSN to be tracked by the school. At most, the school district as a whole might want a record so they could make sure kids are getting schooled but putting that into Canvas doesn't make any sense to me.
    - SoftTalker 5mo ago
      Agreed, seems wild to me that anyone in 2026 is using SSN as an identifier in a system that's not doing some kind of tax reporting. It's kryptonite for any other purpose.
bradyd 5mo ago
> For the ransom group, it is better for them to be perceived as trustworthy. They've already proved themselves to be untrustworthy simply by ransoming you in the first place.
- Ancapistani 5mo ago
  No, they're proven themselves to be malicious. That's not the same thing at all.

MagicMoonlight 5mo ago

I don’t know if that’s really true. Nobody would really give a shit if you leaked where everyone goes to college… because it’s already on their LinkedIn or whatever. The only people it’s valuable for is the ransomee, because they don’t want the reputational hit of having their data everywhere.

HDBaseT 5mo ago
It really isn't as simple as that. You are leaking email addresses that likely otherwise wouldn't be out there publicly. Whilst email addresses and names are "effectively" public, they aren't just in a one big database anyone on the planet can access. Every single one of those email addresses will receive increased spam and phishing attempts, with more isolated information (such as School, First+Last Name, Subjects, Teachers/Lecturers, etc) the phishing attempts can be more refined. i.e, Student receives an email that looks like its from their school (has email footer, has student name, has relevant teacher name, subject name, etc), the user is now more likely to click some sketchy link. These little identifiers add up, especially when cross-references with other leaks. Even more problematic when most of the users wrapped up in a leak like this are under 18 too. A lot of this stuff could be done previously, although the effort and scale to do so would of been higher/harder.

SoftTalker 5mo ago

Depends on what they actually got. Names and email addresses? Considered public and are not so valuable. Universities usually publish those in a directory anyway. Messages between students and instructors? Likely pretty boring, but possibly embarassing or confidential for a given individual. Grades? Could be a FERPA violation. Critical PII such as SSNs? Probably not in the LMS to begin with.

browsingonly 5mo ago
SSNs have been used as student IDs by particularly stupid educational institutions. The 'nice' thing about getting SSNs from students is the likelihood they'll live for a long time after the breach and thus be subject to identity theft for many years to come.
- SoftTalker 5mo ago
  This was common years (decades, really) ago but I'd be surprised if any university today was still doing that. I guess there could still be some....
- kelnos 5mo ago
  My university stopped putting SSNs on student IDs more than 25 years ago. I'd be surprised if there are many who still do that. Though I wouldn't be surprised if some 40 year old university IT system requires its use as an identifier, regardless of whether or not it gets printed anywhere.
Mezzie 5mo ago
I just spoke with a K-12 teacher I know, and she confirmed SSNs in the Canvas instance. Yikes.
- saghm 5mo ago
  Wow. A lot of K-12 students probably don't even know their own SSN off the top of their head, much less understand the impact of having it stored in this way. I can't fathom why it would be necessary for the SSN to be tracked by the school. At most, the school district as a whole might want a record so they could make sure kids are getting schooled but putting that into Canvas doesn't make any sense to me.
  - SoftTalker 5mo ago
    Agreed, seems wild to me that anyone in 2026 is using SSN as an identifier in a system that's not doing some kind of tax reporting. It's kryptonite for any other purpose.

bradyd 5mo ago

> For the ransom group, it is better for them to be perceived as trustworthy. They've already proved themselves to be untrustworthy simply by ransoming you in the first place.

Ancapistani 5mo ago
No, they're proven themselves to be malicious. That's not the same thing at all.