What we know about the Canvas hack impacting thousands of schools
An apparent cyberattack shut down an education platform used by universities and K-12 schools across the US Thursday, depriving students and teachers of essential classroom materials – at a time when many are taking or prepping for final exams.
Canvas, a popular, cloud-based digital hub for classrooms, has more than 30 million active users globally, with more than 8,000 institutions as customers, parent company Instructure says on its website.
Large public school systems and top universities like Columbia, Princeton, Harvard and Georgetown reported a ransom note signed by a hacking group had appeared on the homepage of their schools’ Canvas sites Thursday.
By late Thursday night, Instructure had announced Canvas was available again “for most users,” but a number of schools had already extended deadlines and shuffled finals schedules because of the hack.
Here’s what we know.
How the Canvas hack unfolded
A University of Washington student who tried to log into Canvas around noon Thursday was greeted by a message from the hacking group ShinyHunters, which claimed to have “breached” the platform’s parent company.
The note, reported by different student news outlets, demanded ransoms to prevent data leaks from the platform.
A student at the University of Pennsylvania said he was logged out of his Canvas account while studying for finals. Professors had to scramble to send class materials in other ways, the student said.
Universities across the country, including Columbia University, Rutgers, Princeton, Kent State, Harvard and Georgetown issued statements alerting students to the hack impacting institutions nationwide. School districts in California, Florida, Georgia, Oklahoma, Oregon, Nevada, North Carolina, Tennessee, Utah, Virginia and Wisconsin also reported being affected.
The is the second school data breach claimed by ShinyHunters this month. In Thursday’s ransom note, the group claimed it had hacked Instructure “again” and faulted the company’s response to the previous attack: “Instead of contacting us to resolve it they ignored us and did some ‘security patches.’”
No comments:
Post a Comment