Canvas Cyberattack Shuts Down Schools’ Sites

Procrastinating Intro to Romantic Lit students at thousands of schools were granted a surprise extension on their final essays. Canvas, the platform that about half of all colleges and universities in North America use to manage assignments and share grades, shut down all its sites for a few hours on Thursday, after its parent company, Instructure, suffered a massive cyberattack—just in time for final exams.

Instructure reported late Thursday that Canvas was back for most users, but not before schools like Penn State canceled some exams scheduled for Thursday and Friday.

A hacking group called ShinyHunters took credit for the attack, which it claimed affected 8,800 universities and K-12 schools around the globe and 275 million people’s data. It’s unclear exactly how many users or schools were targeted, as hacker groups sometimes exaggerate the impact to gain media attention or to get a ransom, according to TechCrunch. Some users at Harvard reported seeing a message from the hackers on the school’s Canvas login page during the outage.

The outage was temporary, but:

• Instructure first noted a cybersecurity incident on May 1, when it found that some Student IDs, names, and emails, as well as messages between users on Canvas, were breached.
• Hackers also told some school officials that they’d need to negotiate a settlement with them by May 12 or data would be leaked.

Big picture: ShinyHunters has taken credit for a slew of similar high-profile breaches, hacking and exposing users’ personal information from some of the biggest data-hoarders in the country like Microsoft, Ticketmaster, and Salesforce.—MM