Cyberattack on Canvas Disrupts Global Educational Institutions

A significant cyberattack has compromised the Canvas learning management system, widely used by educational institutions globally. The hacking group ShinyHunters claimed responsibility for the breach, asserting they accessed data from nearly 9,000 schools worldwide, including billions of private messages and records.

Instructure, the parent company of Canvas, confirmed that the breach involved user data such as names, email addresses, student ID numbers, and messages between users. They stated that passwords, dates of birth, government identifiers, or financial information were not affected.

The attack led to widespread disruptions, particularly during the critical final exam period. Universities like the University of Sydney and Penn State University reported outages, with some institutions canceling or postponing exams.

ShinyHunters issued a ransom demand, threatening to leak the stolen data unless payment was made by May 12. The group claimed to have stolen 3.65 terabytes of data, impacting approximately 275 million individuals.

In response, Instructure has revoked compromised access tokens and credentials, patched vulnerabilities, and enhanced monitoring. The company reported that Canvas was fully operational by May 6 and stated that no unauthorized activity had been detected since.

This incident underscores the growing cybersecurity risks faced by educational institutions due to their vast stores of sensitive data. Authorities recommend enabling multi-factor authentication, using secured Wi-Fi networks, keeping systems updated, and being vigilant about suspicious messages or links.