Needham Public Schools Says Canvas Cyberattack Stole Students’ And Staff Data

A nationwide cybersecurity attack left students across the country without access to Canvas, according to WBIR, after the Canvas learning platform was targeted.

“Needham Public Schools said Friday that the personal data of students and staff was stolen as part of a nationwide cyberattack on the Canvas learning platform”

The Boston Globe

Needham Public Schools said Friday that the personal data of students and staff was stolen as part of the nationwide cyberattack on the Canvas learning platform, and the district disabled the system after being notified of the breach by Instructure.

The Boston Globe

Needham Superintendent Dan Gutekanst wrote to families that Instructure confirmed the information accessed included first names, last names, and email addresses for all Needham Public Schools students and staff.

Gutekanst said that "Immediately upon notification of the breach," the district "we disconnected Canvas … to prevent any further potential compromise of data or systems."

The Globe reported that the hack disrupted learning at thousands of schools nationwide, particularly causing chaos at universities where final exams were underway.

The Globe reported that Needham families were told the district was notified twice in the last week that "the Canvas system had experienced a security breach."

Gutekanst said the first notification came on May 1, after which the district was "subsequently informed that data associated with Needham Public Schools had been downloaded," according to the message obtained by the Globe.

The Boston Globe

On Thursday, the district was notified of a second breach, and the message said Instructure later confirmed the personal information was hacked.

The Globe reported that the hacking group named ShinyHunters claimed responsibility for the breach.

Instructure said Friday that most of the system was restored, while Gutekanst told families that "we are operating under the assumption that all students and staff were affected" because the district did not yet have written confirmation from Instructure.

The Globe reported that teacher gradebook data connected to PowerSchool, the district’s student information system, "could have been modified," though the message said "At this time, this has not been confirmed."

“Needham Public Schools said Friday that the personal data of students and staff was stolen as part of a nationwide cyberattack on the Canvas learning platform”

The Boston Globe

Needham Public Schools asked Instructure for a "complete documented accounting of the incident, including exactly what data may have been accessed or modified," according to Gutekanst’s message to families.

The Globe said Canvas is used by schools and universities across the country to manage grades, course notes, assignments, lecture videos, and other learning materials.

Locally, the Globe reported that Boston College, Harvard, Northeastern, and the University of Massachusetts Lowell were among the institutions affected by the hack.

WBIR said the attack left students without access to Canvas, underscoring how the breach disrupted learning systems beyond any single district.