By AJ Vicens
May 8 (Reuters) – Some schools and universities whose students’ data was stolen by a cybercriminal hacking group as part of an April breach of the educational tool Canvas individually sought to deal directly with the hackers to prevent data release, a source familiar with the matter told Reuters on Friday.
ShinyHunters, a hacking group with a string of data theft and extortion campaigns targeting major global companies, said in a May 3 post on its website that it had stolen roughly 6.65 terabytes of Canvas data related to nearly 9,000 schools worldwide that included student names, email addresses and private messages between students, teachers, and other staff.
Student newspapers across the country reported this week that the hack was causing widespread disruption as students prepare for end-of-year tasks and assignments. The software is used by schools to facilitate class assignments and information sharing, as well as messages between students and school faculty.
On May 5, the group posted a message saying that Canvas parent company, Instructure, had “not even bothered speaking to us” to prevent a data leak, and that their demand “was not even as high as you might think it is.” The message included a list of roughly 1,400 individual schools and districts, and invited the schools to contact them to negotiate and prevent data from being posted.
The Cornell Daily Sun reported Friday that the Canvas hack disrupted students trying to study for final exams.
Instructure announced in a May 1 post on its support website that it was investigating a cybersecurity incident. A post the next day, signed by Chief Information Security Officer Steve Proud, said the “information involved” included Canvas user names, email addresses, student ID numbers and messages among users. In a May 6 update, the company said the situation was resolved and that Canvas was fully operational.
On May 7, students at multiple schools reported attempting to log into Canvas and finding a note from ShinyHunters with a link to the list of affected schools. Instructure pulled Canvas, Canvas Beta and Canvas Test offline a short time later, but restored access to Canvas four hours later.
Canvas Beta and Canvas Test remain in “maintenance mode,” according to Instructure’s support site.
ShinyHunters pulled both messages off its website as of May 7, replacing them with a message saying they were “not commenting and have no further comment to make regarding this global incident.” A group representative declined to answer questions from Reuters sent via online chat.
Extortion and ransomware groups pull claims about victims off their websites for any number of reasons, including sometimes that a target has paid or is in negotiations.
A note sent to parents from the South Orange-Maplewood School District Friday said the security breach occurred April 25 and that Instructure detected unauthorized activity April 29.
Montgomery County Public Schools in Maryland told students, staff and families in an email Friday that Canvas was returning to service, but that the district was continuing to restrict access out of an abundance of caution “until all services have been reviewed and confirmed safe for use.”
Instructure did not respond to a request for comment Friday.
Canvas has 30 million active users between kindergarten and college age, according to Instructure’s website.
(Reporting by AJ Vicens in Detroit; Editing by Chris Sanders and Aurora Ellis)
