The Canvas Hack Is a New Kind of Ransomware Debacle
Key takeaways
- In a list published by the hackers behind the attack on their ransom-focused dark web site, they claim the breach affected more than 8,800 schools.
- TechCrunch reported on Thursday that the hackers launched a secondary wave of attacks, defacing some schools' Canvas portals by injecting an HTML file to display their own message on the schools' Canvas login pages.
- Instructure did not immediately respond to a request for comment about Thursday's outages and how they fit into the bigger picture of the breach.
Why this matters: a development in AI with implications for how people work, create, and decide.
Harvard University campus in Cambridge, Massachusetts PHOTOGRAPH: GETTY IMAGESComment Loader Save Story Save this story Comment Loader Save Story Save this story Higher education has long been a target of ransomware gangs and data extortion attacks. But never before, perhaps, has a cyberattack against a single software platform so thoroughly disrupted the daily operations of thousands of schools across the United States.
The widely used digital learning platform Canvas was put into “maintenance mode” on Thursday after its maker, the education tech giant Instructure, suffered a data breach and faced an extortion attempt by attackers using the recognizable moniker "ShinyHunters." Though the hackers have been advertising the breach and attempting to extract a ransom payment from Instructure since May 1, the situation took on additional immediacy for regular people across the US and beyond on Thursday because the Canvas downtime caused chaos at schools, including those in the midst of finals and end-of-year assignments.
Universities like Harvard, Columbia, Rutgers, and Georgetown sent alerts to students about the situation in recent days; other institutions, including school districts in at least a dozen states, also appear to have been affected. In a list published by the hackers behind the attack on their ransom-focused dark web site, they claim the breach affected more than 8,800 schools. The exact scale and reach of the breach is currently unclear, though. And the fact that Canvas was down throughout Thursday afternoon and evening further complicated the picture.