Canvas learning platform hit by cyberattack

Instructure, the parent company of cloud-based education platform Canvas, said it temporarily deactivated its Free-For-Teacher accounts after a Thursday cyberattack. The hack, attributed to the ShinyHunters criminal group, affected thousands of colleges and K-12 schools nationwide, preventing some from accessing the site during final exams. Instructure made the decision to shut down the free accounts after discovering that the hackers repeatedly exploited a vulnerability in those accounts to access Canvas and change some of its pages, the company said. Instructure was investigating and had notified the FBI and the U.S. Cybersecurity and Infrastructure Security Agency, it said.

The company did not provide a timeline for the restoration of the free accounts, though the paid version of the platform was back online Friday. It’s unclear exactly how many teachers use the free accounts to track student assignments and grades, but about 30 million people or institutions use either free or paid versions of Canvas, according to the Instructure website. That number includes more than 8,000 institutions that were affected by the hack.

What did the hackers do? They claimed to have stolen over 3.65 terabytes of data from 275 million individuals including students and teachers, according to the student newspaper of California State University, Sacramento, which was affected by the hack. The group alleged that it had access to private messages exchanged on the platform as well as Salesforce company data. It gave Instructure a May 12 deadline to negotiate a settlement or face a data leak.

Instructure confirmed that the hackers stole personal information of some users on April 29, including names, email addresses, student ID numbers, and internal messages. Information such as passwords and financial details didn’t appear to be included in the hack, the company said. The hackers didn’t appear to have obtained additional information during their Thursday attack, according to Instructure. The company said it notified affected users on Tuesday, but didn’t say how it intended to respond to the hackers’ ultimatum.

What have cybersecurity experts had to say? In a statement emailed to WORLD, Cliff Steinhauer, director of Information Security and Engagement at the National Cybersecurity Alliance, said the breach underscores how deeply schools are dependent on centralized digital platforms to keep day-to-day academic operations running. He called on schools and technology vendors to strengthen vendor risk management, improve incident response planning, and treat cybersecurity with increased seriousness. He added that similar attacks can be expected in the future.

Dig deeper: Read Liz Lykins’ report on accusations that a Chinese man hacked U.S. COVID medical research.