Canvas outage during cyberattack disrupts finals at schools, universities

A cyberattack on Canvas, a widely used learning management system for grades, assignments, and course materials, left nearly 9,000 schools worldwide offline on May 9. The hacking group ShinyHunters claimed responsibility, stating they accessed billions of private messages and other records. The group had previously threatened to leak the data, with deadlines set for May 9 and May 12, suggesting ongoing negotiations over potential extortion payments. The outage caused chaos as students prepared for finals, with many unable to access course materials or submit assignments. Universities like the University of Iowa, Virginia Tech, and Harvard confirmed disruptions, while school districts in Spokane, Washington, and others issued updates to parents and students. The University of Iowa’s IT director described it as a 'national-level cybersecurity incident,' while Virginia Tech acknowledged the impact on final exams. Instructure, the company behind Canvas, did not respond to requests for comment or confirm whether the system was taken down as a precaution or due to the attack. The breach mirrors a previous incident involving PowerSchool, another learning management tool, where a Massachusetts college student was later charged in connection with the attack. ShinyHunters, described as a loose group of teenagers and young adults based in the U.S. and U.K., has been linked to other high-profile attacks, including one on Ticketmaster’s Live Nation subsidiary. Schools and universities are increasingly targeted by hackers seeking sensitive digital data, which was once stored securely in physical records. Teachers and faculty, including Damon Linker of the University of Pennsylvania, reported difficulties in helping students access materials for exams. The University of Texas at San Antonio and other institutions began issuing statements to reassure students and parents, though concerns about data security and phishing attempts remain. The incident underscores the growing vulnerability of educational institutions to cyber threats.