CHAOS erupted at schools and colleges across the US on Thursday as a cyberattack disrupted Canvas just as students were due to take final exams, with Instructure saying the platform was back online by Friday morning. The company reported that it briefly took Canvas offline after identifying unauthorized activity in its network, and that the same threat actor linked to a prior data breach was involved, data accessed including user names, email addresses, student ID numbers, and messages exchanged on the platform.
Ransom notes appeared on Canvas login pages, and the group behind the breach, ShinyHunters, claimed responsibility on its dark web site, asserting the data came from 275 million people associated with 8,800 schools. The University of Illinois reportedly postponed all final exams and assignments for Friday to Sunday, while the University of Massachusetts Dartmouth rescheduled or extended due dates for exams. No indication was given that passwords, dates of birth, government identifiers, or financial information were involved. According to Instructure.