ShinyHunters Ransom Messages Disrupt Canvas, Affecting 275 Million Students in U.S. and Canada

A massive cyberattack against Canvas left thousands of students in the United States without access to assignments, grades, and academic materials during final exam season, after students tried to log in and found ransom messages posted by the attackers.

“A weird text from my dad in February sent me on a months-long quest to solve a mystery that has been troubling an odd group of victims from a Columbia University data breach last year”

Ars Technica

The outage began to be reported on Thursday, and the platform is owned by Instructure, which said it had more than 30 million active users worldwide.

Ars Technica

Instructure said the hacker group ShinyHunters had already carried out another attack on May 1, compromising data such as usernames, email addresses, and student identification numbers.

In the United States and Canada, BFM reported that nearly 9,000 institutions and 275 million people would have been affected, with the hacker group ‘ShinyHunters’ claiming responsibility and demanding payment.

Radio-Canada also reported that the culprit was a flaw affecting the Canvas platform, which is widely used to deliver courses, share resources, and manage assessments.

In universities, colleges, and some K-12 schools, teachers use Canvas to share notes and assignments, and Instructure said the data involved may include full names, email addresses, student numbers, and personal messages.

Instructure detected unauthorized activity on April 29 through a particular type of teacher account, revoked that access, and took the platform offline to investigate on Thursday when additional activity was detected.

BFM

Instructure also said it has found no evidence that passwords, financial information, or government-issued identification data have been compromised.

Luke Connolly, a threat intelligence analyst in Ottawa with cybersecurity firm Emsisoft, said the breach was concerning because there are all kinds of ways the information can be misused.

Robert Falzon, head of engineering at Check Point Software for Canada, said the information could be combined with data leaked elsewhere to create profiles for false identities used in financial crimes.

Beyond Canvas, La Libre.be described an internal leak tied to ICE that provided to an independent organization the identities of about 4,500 ICE agents and former ICE and border police officers, which it said would be the largest data leak ever recorded within that department.

“Cyberattack compromising data of students and teachers on the Canvas learning platform”

Cubadebate

Dominick Skinner, founder of the ICE List site, said the leak was "the sign of generalized discontent within the American government," and the article linked that distrust to the death of Renee Nicole Good in Minneapolis.

In the same reporting, the United Nations called for the opening of a "swift and independent" investigation into Renee Nicole Good's death, while protests erupted in several major cities targeting ICE and also the FBI.

In the Canvas incident, David Shipley, CEO of Beauceron Security in Fredericton, estimated it could be the "largest cyberattack ever carried out in the education sector," describing an "incredibly destructive" attack.

Falzon said it is "not enough to run cybersecurity audits from time to time," arguing that breaches occur daily now and that schools and external providers must shorten those cycles and involve the community.