Millions of students were caught off guard on May 7 when a cyberattack took Canvas down.
Students were attempting to do things like study for final exams, turn in work, and find assignments, but couldn’t do anything due to the cyber attack. The attack affected middle schoolers, high schoolers, and college students, even at prestigious institutions like Harvard and Princeton.
Students were met instead with a ransom message from a hacking group called ShinyHunters.
The group threatened to release the data of students and sell it to third-party organizations unless Instructure, the company that manages Canvas, arranged a settlement with them by May 12.
ShinyHunters is a hacking group that formed during the pandemic in 2020; they sell stolen information about people on the dark web. Similar to their previous operations hacking AT&T, Ticketmaster, and Qantas Airlines, their Canvas hacking followed the same model of stealing data, then giving the victims a chance to pay before it goes public.
The incident began on April 25, when unauthorized actors accessed Canvas systems. Instructure detected the intrusion four days later and engaged third-party cybersecurity experts.
The company attempted to install security patches instead of negotiating with the hackers, leading ShinyHunters to strike again on May 7 and putting a public ransom note giving Instructure until May 12 to settle negotiations.
The whole methodology of the hacking group centered around exploiting an issue relating to how Free for Teacher accounts work in Canvas. When Instructure realized this was how their system was breached, they immediately shut down those accounts. Thus, this resulted in Instructure being able to fight back against the breach and restore access to Canvas for everyday users, no matter if they are in college or high school.
This restoration occurred only a few hours after the initial ransom appeared on students’ Canvas screens on May 7. By the next morning, Canvas was fully online for everyone, though some schools had already changed deadlines and final schedules to circumvent the hack.
For students at Skyline, the effects of this hacking incident were minimal, as Skyline freshman Keyan Y. stated, “the outage didn’t really have any impact, as Canvas was only down for a couple hours.”
It is still important to stay vigilant and to notice if anything suspicious occurs with your Canvas account, as you do not want your data to be sold to people online.
For more information:
Canvas hack: Company pays criminals to delete students’ stolen data
What we know about the Canvas hack that has impacted thousands of schools
