Schools reach out to Canvas hackers as breach hits US classrooms: report

Some schools and universities whose students’ data was stolen by a cybercriminal hacking group as part of an April breach of the educational tool Canvas have reached out to the hackers to prevent their data from being released, a source familiar with the matter said on Friday.

ShinyHunters, a hacking group with a string of data theft and extortion campaigns targeting major global companies, said in a May 3 post on its website that it had stolen roughly 6.65 terabytes of Canvas data related to nearly 9,000 schools worldwide that included student names, email addresses and private messages between students, teachers, and other staff.

Student newspapers across the country reported this week that the hack was causing widespread disruption as students prepare for end-of-year tasks and assignments. The software is used by schools for class assignments and information sharing, as well as messages between students and school faculty.

The FBI said on Friday it was aware of a breach disrupting the U.S. education system, without naming Canvas.

On May 5, the group posted a message saying that Canvas’ parent company, Instructure, had “not even bothered speaking to us” to prevent a data leak, and that their demand “was not even as high as you might think it is”.

The message included a list of roughly 1,400 individual schools and districts, and invited the schools to contact them to negotiate and prevent data from being posted.

Instructure announced in a May 1 post on its support website that it was investigating a cybersecurity incident. A post the next day, signed by Chief Information Security Officer Steve Proud, said the “information involved” included Canvas user names, email addresses, student ID numbers and messages among users.

In a May 6 update, the company said the situation was resolved and that Canvas was fully operational.

On May 7, students at multiple schools reported attempting to log into Canvas and finding a note from ShinyHunters with a link to the list of affected schools. Instructure pulled Canvas, Canvas Beta and Canvas Test offline a short time later, but restored access to Canvas four hours later.

An Instructure spokesperson said in an email Friday that the hackers “made changes to pages that appeared when some students and teachers were logged in”. The hackers exploited an issue related to the company’s Free-for-Teacher service, the spokesperson said, which allows non-Canvas users to try certain parts of the platform.

The company has temporarily shut down the Free-for-Teacher service, which “gives us confidence to restore access to Canvas, which is now fully back online and available for use”, the spokesperson said.

Canvas Beta and Canvas Test remain in “maintenance mode”, according to Instructure’s support site.

ShinyHunters pulled both messages off its website as of May 7, replacing them with a message saying they were “not commenting and have no further comment to make regarding this global incident”. A group representative declined to answer questions from Reuters sent via online chat.

Extortion and ransomware groups pull claims about victims off their websites for any number of reasons, including sometimes that a target has paid or is in negotiations.

A note sent to parents from the South Orange-Maplewood School District on Friday said the security breach occurred on April 25 and that Instructure detected unauthorised activity on April 29.

Montgomery County Public Schools in Maryland told students, staff and families in an email on Friday that Canvas was returning to service, but that the district was continuing to restrict access out of an abundance of caution “until all services have been reviewed and confirmed safe for use”.

Canvas has 30 million active users between kindergarten and college age, according to Instructure’s website.