Colleges and universities nationwide are grappling with the aftermath of a significant outage affecting Canvas, an online platform essential for managing
exams, course materials, and grades. This disruption, attributed to a cyberattack, occurred during finals week, a critical period for students and educators who depend on the platform. By late Thursday, Instructure, the parent company of Canvas, reported that the platform had resumed functionality for most users. However, some institutions are still restricting access as they evaluate ongoing security concerns.
Details of the Cyberattack
The hacking group ShinyHunters has claimed responsibility for the breach, according to Luke Connolly, a threat analyst at the cybersecurity firm Emsisoft. As of Friday, Instructure and Canvas were no longer listed as targets on ShinyHunters' site.Despite the restoration of access for many users, certain schools have opted to maintain restrictions for students and faculty as a precautionary measure while they assess potential security vulnerabilities.
Understanding Canvas
Canvas serves as a comprehensive educational platform, allowing schools and universities to manage grades, digital lectures, course materials, and facilitate communication between students and instructors. It also supports assessments such as quizzes and exams, making it a vital resource during the finals period.Profile of ShinyHunters
ShinyHunters is a loosely organized group of young hackers from the U.S. and the U.K., known for involvement in large-scale cyberattacks, including one targeting Ticketmaster. They describe their operations as 'rooting your systems since ‘19,' a term indicating deep access to computer systems.Earlier in the week, ShinyHunters warned that failure to meet their ransom demand by May 6 could result in the exposure of data from nearly 9,000 schools and 275 million individuals. They later extended this deadline, suggesting that some institutions were in negotiations.
In a statement on their ransomware site, the group indicated they would not provide further comments regarding this incident.
Impact on Students
The breach appears to have compromised student ID numbers, email addresses, names, and messages on the Canvas platform, as noted by Instructure’s chief information security officer, Steve Proud. He confirmed that there was no evidence of compromised passwords, dates of birth, or financial information.Although many institutions have restored Canvas access, the disruptions during finals are expected to have lingering effects. The University of Massachusetts at Dartmouth announced the postponement of exams scheduled for Friday and Saturday, allowing students additional time to prepare.
Similarly, the University of Illinois postponed all exams set for Friday, Saturday, and Sunday across all classes, irrespective of their reliance on Canvas. In Maryland, Montgomery County Public Schools continued to limit Canvas access, citing a need for further understanding of the incident's full impact.
