Canvas hack hits 8,000 schools and exposes millions of student records

A hacking group called ShinyHunters says it broke into Instructure, the company that runs the online classroom platform Canvas, for the second time this month. They stole millions of student and faculty records and cut off Canvas access for schools across Georgia and the United States.

What’s Happening: The attack began Thursday, May 7, when students attempting to log into Canvas were redirected to a message from ShinyHunters claiming credit for the breach. The hacking group threatened to release 3.65 terabytes of data allegedly stolen during its initial breach of Instructure on May 1 unless the company contacted them before May 12.

What Was Taken: The hackers say they took millions of records, including names, email addresses, student ID numbers, and private messages sent through Canvas. Instructure said it has not found any evidence that passwords, Social Security numbers, or financial information were taken, but the investigation is still ongoing.

How This Affects Real People: Canvas is the platform millions of students and teachers use every day to turn in assignments, check grades, take quizzes, and send messages. More than 8,000 schools and universities were reportedly affected. Some schools postponed exams and switched to backup systems while Canvas was down. More than 20 Georgia institutions were listed among those hit, including:

– Georgia Tech, Georgia State University, Clark Atlanta University, Emory University, and Emory Healthcare

– Atlanta Public Schools, Cobb County Schools, Gwinnett County Schools, Jackson County Schools, and Marietta County Schools

– Middle Georgia State University, Georgia Military College, Augusta University Cyber Center, and Middle Georgia Regional Educational Service Agency

– Gwinnett College, Gwinnett Tech, John Marshall Law School in Atlanta, Atlanta CDL Training School, and Gwinnett County Government Water Resources

– The Georgia Department of Education and the Georgia Department of Corrections

Fulton County’s Response: Fulton County Schools announced May 8 that it temporarily disabled access to all teacher and student Canvas accounts following the recent cybersecurity concerns. District officials advised students and staff not to access Canvas until further notice and warned the community to be cautious of phishing attempts.

In their statement, the district also said that its own technology systems are not currently at risk and that officials are taking preventative measures to maintain security. Fulton County Schools also said it is closely monitoring updates from the Canvas team and the Georgia Department of Education and will continue providing updates to the community.

Where Things Are Now: As of May 8th, many Canvas systems are back online after Instructure took parts of the platform offline to work on the problem. Instructure has not paid the ransom to ShinyHunters.

About ShinyHunters: Not much is publicly known about ShinyHunters, but the group has been active since 2020, with a track record of targeting companies for money through data theft and extortion. Previous ShinyHunters targets from the last 5 years include the EU Commission, Ticketmaster, Pornhub, GrubHub, and AT&T. 

How to Protect Yourself: Here are several steps people can take when their personal data may have been exposed in a breach. 

– Change your password on the website that has been breached and any other accounts that use the same password.

– Turn on two-factor authentication, a security setting that requires a second step, such as a text message code, to log in.

– Watch for phishing emails, which are fake messages designed to look real and trick you into clicking a link or giving up personal information.

– Do not click links in unexpected emails or text messages.

– Monitor your email account for unusual activity or login attempts you do not recognize.