Instructure Inc

Let's kick it off with Shiny Hunters because they're back in the headline.

They've been behind breaches like Instructure, Aura, Charter, and dozens of others this year.

They're now claiming it breached the FBI itself using a previously unknown Oracle PeopleSoft vulnerability.

The group says the flaw is a pre-authentication remote code execution bug that it discovered and successfully exploited Monday night against, uh, apply.fbijobs.com, the FBI's recruitment portal running PeopleSoft HCM.

New data shows that about seventy percent of US workers feel unprepared for today's workforce.

That raises a bigger question: is the problem education, employers, or how we think about skills altogether? Today, I'm joined by Ryan Lufkin, the VP of Global Strategy Instructure.

He has spent years helping companies and institutions rethink how people actually become job ready, and we're getting into what's broken and what needs to change.

Ryan, welcome to Right About Now.

We're like brothers from another...

Talk to me, man.

Instructure, what that word means.

We're the makers of Canvas.

They stepped above the incident.

They engaged with Instructure internationally to ensure that they could centralize information that was coming down the line and share that through to schools and university so that everyone was working together hand in hand.

And look, I think the key lessons are everybody did a really good job on this.

Everybody lent in.

And also, whilst we tested a large scale event, we haven't actually tested the upper limits of the capacity of the incident response industry to mobilize.

So for example, the conversations that we're having now is how do we deal with 1,000 incidents that come in all at once? And thankfully in this case, our CAP plan activated and worked as intended and didn't impact BAU, but we're thinking deeply about how do we deal with this for the next one.

And then lastly, from the incident itself, many would've seen in the news that Instructure reached an agreement with a threat actor, and so thankfully data wasn't published.

But if that occurred, there would've been a whole new layer of response that wasn't, that would've been needed to prevent people from accessing the dark web and seeking out information and having to allay concern amongst staff, students, and parents.

You have central banks having emergency meetings about what happens in terms of financial security, about data breaches, and so on.

We saw this with Instructure.

Like, you know, 280 million student records, 8,000 institutions impacted by And higher ed was always a low priority target, but now there's almost no price to making, to attacking almost any target.

So it just, the power and the lack of regulatory oversight is really a little bit frightening right