Some schools and universities affected by an April cyberattack on the educational tool Canvas have reached out to the hacking group responsible, a source familiar with the matter said on Friday. Their aim is to prevent the release of stolen student data.
The hacking group ShinyHunters, known for data theft and extortion, claimed responsibility for the breach in a website post. It stated roughly 6.65 terabytes of Canvas data was stolen from nearly 9,000 schools globally. The stolen information, according to ShinyHunters, includes student names, email addresses, and private messages among students, teachers, and other staff, while Instructure's CISO later confirmed student ID numbers were also involved.
Student newspapers reported widespread disruption caused by the hack, particularly as students prepared for end-of-year tasks and assignments. Canvas is used for class assignments, information sharing, and communication between students and faculty. The FBI confirmed on Friday its awareness of a breach disrupting the U.S. education system, though it did not specifically name Canvas.
In a later message, ShinyHunters stated that Instructure, Canvas' parent company, "had not even bothered speaking to us" to prevent a data leak. The group added its demand "was not even as high as you might think it is." This message included a list of approximately 1,400 individual schools and districts, inviting them to negotiate to prevent data from being posted.
Instructure initially announced on its support website it was investigating a cybersecurity incident. A subsequent post, signed by Chief Information Security Officer Steve Proud, confirmed the "information involved" included Canvas usernames, email addresses, student ID numbers, and messages among users. The company later stated the situation was resolved and that Canvas was fully operational.
Students at various schools reported encountering a note from ShinyHunters, which included a link to affected schools, when attempting to log into Canvas. Instructure then took Canvas, Canvas Beta, and Canvas Test offline. Access to Canvas was restored four hours later.
An Instructure spokesperson confirmed the hackers "made changes to pages that appeared when some students and teachers were logged in." The spokesperson explained the hackers exploited an issue with the company's Free-for-Teacher service, which allows non-Canvas users to try certain parts of the platform. This service has been temporarily shut down. The shutdown "gives us confidence to restore access to Canvas, which is now fully back online and available for use," the spokesperson added.
Canvas Beta and Canvas Test remain in "maintenance mode," according to information on Instructure’s support site. ShinyHunters later removed its previous messages from its website, replacing them with a statement that the group was "not commenting and have no further comment to make regarding this global incident." A group representative declined to answer questions from Reuters sent via online chat.
Extortion and ransomware groups often remove claims about victims from their websites for various reasons. These reasons can include a target having paid or being in negotiations.
A note to parents from the South Orange-Maplewood School District indicated the security breach occurred April 25 and that Instructure detected unauthorized activity April 29. Montgomery County Public Schools in Maryland informed students, staff, and families in an email Friday that Canvas was returning to service. The district, however, continued to restrict access as a precaution, stating access would remain restricted "until all services have been reviewed and confirmed safe for use."
Canvas serves 30 million active users, ranging from kindergarten to college age, according to Instructure's website.
Schools and universities have contacted the ShinyHunters hacking group regarding an April data breach of the Canvas educational tool.
ShinyHunters claims to have stolen 6.65 terabytes of data from nearly 9,000 schools, including student names, email addresses, and private messages.
Instructure, Canvas' parent company, confirmed a cybersecurity incident and initially identified compromised data, later stating Canvas was fully operational.
Source: REUTERS
