Canvas cyberattack: Disruptions aplenty as universities cancel or postpone exams, assignments

Disruptions for college students are set to drag into the weekend after hackers briefly took down an online platform used by thousands of schools around the world, from Princeton University in the US to the University of Manchester in Britain and the Universidad del Desarrollo in Chile.

Instructure Inc., which runs the Canvas service used by students to take tests and get grades, said it was forced to suspend the portal on May 7 after breaches by a “criminal threat actor”.

The perpetrators exploited a vulnerability in a specific account for teachers, the company said, gaining access to some of its websites. The KKR & Co.-owned company restored much of the service on May 7, though the teacher accounts remain suspended.

The hackers took data including Canvas users’ names, e-mail addresses, student identification numbers and messages among users, according to a statement on the company’s website on May 8.

The firm said it notified the US Federal Bureau of Investigation, the US Cybersecurity and Infrastructure Security Agency and law enforcement agencies abroad of an initial breach on April 29 and then another related one on May 7.

The company investigation has found no evidence that passwords, dates of birth, government identifiers or financial information were taken, it said.

The FBI said on May 8 that it is aware of the disruption and asked victims to file complaints at ic3.gov. The agency also warned people not to respond or send payment to anybody who claimed to have their data. 

College students use Canvas for everything, from accessing course materials and turning in assignments, to checking grades and taking tests.

Schools around the world – from Stanford University in California to the University of Oslo in Norway, Australia’s Adelaide University and several in Singapore – reported problems with the portals on May 7.

The systems for Yale University, Columbia University and Harvard University were also down for hours. 

At Southern Methodist University, the platform was restored late on May 7, but the hack disrupted students’ testing schedules, with the school pushing May 8 exams to May 10, a spokesperson said.

On other college campuses, some tests and assignments have been postponed or cancelled, while others have not, according to interviews with students and faculty.

Lennon Aledia, a senior at Northwestern University, said a professor told him an exam was likely to be cancelled.

“Of course, the situation is not great, but I’m looking forward to having a little bit more room to breathe this weekend,” he said.

The university also pushed back the drop deadline for classes in the spring quarter to May 11 because of the hack, according to an e-mail from the school’s provost office reviewed by Bloomberg. 

“We’re extending the deadline to Monday night but we have no idea if we’ll have things running by then,” said Mr Mark Witte, the director of undergraduate studies for the school’s economics department. “The drop deadline’s fairly arbitrary.”

With the scarcity of information from administrators, other professors have turned to Mr Witte for guidance.

“The level of communication has not been perhaps as helpful as it could have been,” he said.

At Harvard University, the Canvas service was back online on the morning of May 8. But Mr Lorenzo Ruiz, a junior, still had questions.

“Little further information was provided other than that they had contained the cyber incident,” Mr Ruiz said. “I’m left wondering what data hackers still got away with.”

Some of Instructure’s K-12 school customers and districts were also affected, including Hillsborough County Public Schools, which includes Tampa, according to a spokesperson.

New York City Public Schools, the largest K-12 district in the US with about a million students, has seven schools impacted by the Canvas hack, according to the district spokesperson.

“The disruption of Canvas is happening at an especially cruel time, right as students are preparing for final exams and graduation,” said Danny Jenkins, chief executive officer of the cyber security firm ThreatLocker.

“Students are panicked, and that’s exactly what the attackers wanted in an effort to pressure Instructure and schools.”

Instructure staff first noticed “unauthorised activity” on its Canvas platform on April 29, according to the company’s statement. The firm “immediately revoked the unauthorised party’s access”.

Nonetheless, on May 7, the company found more “unauthorised activity tied to the same incident,” with the hackers changing the landing page that some students and teachers see when logged in to Canvas, according to the statement.

Instructure said it then took Canvas offline to contain the breach.

The company said it is taking various steps to prevent future breaches, including by rotating security credentials and deploying new protections on its system. It said none of its products beyond Canvas were affected.

A cybercrime group, ShinyHunters, said it was responsible for the hack in a dark web post seen by Bloomberg News, but Instructure has not confirmed the source. ShinyHunters is known for stealing victims’ data and then demanding extortion fees.

“The attackers’ ability to deface log-in systems also suggests a level of access to servers and systems that increases the likelihood they may have had access to sensitive databases,” Mr Jenkins said.

“It’s equally important affected institutions take action. Once Instructure restores systems, schools should be minimising privileges, resetting passwords and monitoring for phishing attempts using exposed data.”

KKR and Instructure are facing several federal lawsuits over the breach. BLOOMBERG