A cyber attack on canvasThe learning management system used by thousands of K-12 schools, colleges, and universities was knocked offline on Thursday, May 7, leaving millions of students and teachers without access to course materials — as many schools and colleges move closer to the final semester.
The hacking group ShinyHunters claimed responsibility for the breach and posted a list on a dark web site that said more than 8,800 institutions were affected. instructorThe parent company behind Canvas placed Canvas, Canvas Beta, and Canvas Test in maintenance mode during the investigation. While the company is reporting that it has restored access for most users late Thursday evening, there are still multiple reports about the outage on social media.
What happened revealed: The instructor said the data stolen included users’ names, email addresses, student ID numbers, and messages exchanged on the platform. The company said it found no evidence that passwords, dates of birth, government identifiers or financial information were involved.
The hackers have given time till May 12 to pay the ransom, otherwise they will leak the data publicly. The earlier deadline of May 8 has already passed, and cybersecurity researchers tracking the group say extortion negotiations may still be ongoing.
Scope of Disturbance: According to Instruct, Canvas has more than 30 million active users globally and more than 8,000 institutional clients. Inside Higher Ed Report Canvas is used by approximately 41% of higher education institutions in North America, making it the dominant learning management system (LMS) in the region.
Some of the affected colleges include Harvard, Columbia, Rutgers, Georgetown, University of Pennsylvania, Virginia Tech, University of New Mexico, University of Florida, Johns Hopkins, Duke, and the University of Iowa.
The University of Texas at San Antonio pushed back Friday’s finals. The University of California system has temporarily blocked or redirected Canvas access at its locations as a precaution.
Disruption was also reported in the United Kingdom, Australia, New Zealand, Sweden and the Netherlands, where 44 institutions were affected.
Two major risks for students: In addition to the threat of leaked personal data, some students and teachers have raised concerns about the integrity of grade and assignment records kept in Canvas. Final grades, submission timestamps, and academic records all flow through the platform. Some Johns Hopkins students reported error messages Thursday when attempting to view final grades. And if there is a problem, what are schools doing to push deadlines and validate information?
The University of Florida warned students to keep an eye out for phishing emails posing as Canvas notifications — a common follow-up tactic after a major breach.
what to watch: May 12 is the next ransom deadline. If the instructor does not negotiate, the data may be publicly posted on the dark web. Schools have begun notifying students and parents and are likely to launch free identity protection services, as has become standard after major breaches of this size. Lawsuits will also probably be filed.
How it connects: Education technology has become a high-value target for ransomware crews. The Canvas violation is very similar to a recent incident attack on powerschoolAnother major learning management vendor exposed millions of student records and federal charges were filed against a Massachusetts college student. Previous attacks have also involved Minneapolis Public Schools and the Los Angeles Unified School District.
For students concerned about identity theft, a free security freeze with all three credit bureaus (Equifax, Experian, and TransUnion) along with monitoring of your credit remains the most effective protection.
This is also a good moment to change your password, especially if you use the same password to login to Canvas as you do with other tools.
Student loan borrowers should be especially cautious: Stolen email addresses are often used to start fake servicer or financial aid scams.
It’s important to remember that most people’s data has already been stolen, so the key is to make sure you stay alert to its misuse.
Don’t miss these other stories:
