The Canvas Hack Is a New Kind of Ransomware Debacle (wired.com)
- Reference: 0183159398
- News link: https://it.slashdot.org/story/26/05/08/0622227/the-canvas-hack-is-a-new-kind-of-ransomware-debacle
- Source link: https://www.wired.com/story/canvas-hack-shinyhunters-ransomware-instructure/
> Higher education has long been a target of ransomware gangs and data extortion attacks. But never before, perhaps, has a cyberattack against a single software platform so thoroughly disrupted the daily operations of thousands of schools across the United States. The widely used digital learning platform Canvas was put into "maintenance mode" on Thursday after its maker, the education tech giant Instructure, suffered a data breach and faced an extortion attempt by attackers using the recognizable moniker "ShinyHunters." Though the hackers have been advertising the breach and attempting to extract a ransom payment from Instructure since May 1, the situation took on additional immediacy for regular people across the US and beyond on Thursday because the Canvas downtime caused chaos at schools, including those in the midst of finals and end-of-year assignments.
>
> Universities like Harvard, Columbia, Rutgers, and Georgetown sent alerts to students about the situation in recent days; other institutions, including school districts in at least a dozen states, also appear to have been affected. In a list published by the hackers behind the attack on their ransom-focused dark web site, they claim the breach affected more than 8,800 schools. The exact scale and reach of the breach is currently unclear, though. And the fact that Canvas was down throughout Thursday afternoon and evening further complicated the picture. In a running incident [2]update log that began on May 1, Steve Proud, Instructure's chief information security officer, said that the company had "recently experienced a cybersecurity incident perpetrated by a criminal threat actor." He added on May 2 that "the information involved" for "users at affected institutions" included names, email addresses, student ID numbers, and messages exchanged by users on the platform.
>
> The situation was ultimately marked as "Resolved" on Wednesday, with Proud writing that "Canvas is fully operational, and we are not seeing any ongoing unauthorized activity." At midday on Thursday, though, the Instructure status page registered an "issue" where "some users are having difficulties logging into Student ePortfolios." Within a few hours, the company had added another status update: "Instructure has placed Canvas, Canvas Beta and Canvas Test in maintenance mode." Late Thursday evening, the company said that Canvas was available again "for most users."
>
> TechCrunch [3]reported on Thursday that the hackers launched a secondary wave of attacks, defacing some schools' Canvas portals by injecting an HTML file to display their own message on the schools' Canvas login pages. According to [4]The Harvard Crimson , attackers modified the Harvard Canvas login page to show a message that included a list of schools that the hackers claim were impacted by the breach. The message from attackers "urged schools included on the affected list to consult with a cyber advisory firm and contact the group privately to negotiate a settlement before the end of the day on May 12 -- or else risk their data being leaked," The Crimson reported. "It is unclear what information tied to Harvard affiliates was included in the alleged breach."
[1] https://www.wired.com/story/canvas-hack-shinyhunters-ransomware-instructure/
[2] https://status.instructure.com/incidents/9wm4knj2r64z
[3] https://techcrunch.com/2026/05/07/hackers-deface-school-login-pages-after-claiming-another-instructure-hack/
[4] https://www.thecrimson.com/article/2026/5/8/canvas-breach-down/
This is a systemic problem, not an isolated one (Score:3)
1. A few decades ago, universities/colleges ran their own IT infrastructure: email, web, applications, etc. But grossly-overpaid administrators decided that competent, experienced IT staff making far less were expendable and they began outsourcing everything they possibly could -- because, of course, reducing the number of administrators and their compensation was never an option.
The consequences of that are now here. What were 8,000 targets are now: 1. And this isn't the only such application -- for example, much the same thing is true of email. And thus attackers now have luxury of focusing their efforts on a single target andl leveraging that into extortion against 8,000. None of the clueless, selfish, ignorant administrators responsible for this debacle will admit any responsibility -- ever. They're too busy enjoying their mansions while graduate students struggle to afford ramen for breakfast, lunch, and dinner, and junior faculty are forced to moonlight in order to make ends meet.
2. Instructure is following the standard playbook here: lie, lie, lie. They're doing that because they know they can and because no will ever hold them accountable. It's clear from what we already know that this was a very thorough hack, Instructure knows it was a very thorough hack, and they're doing everything they can to hide that fact. And as a result of that, they're deliberately making it impossible for everyone at those 8,000 institutions to understand what really happened and to take appropriate defensive measures (if any, if possible). Instructure isn't in the least bit concerned about the damage done to all the students and faculty; Instructure only cares about itself.
Re: (Score:2)
> =And this isn't the only such application -- for example, much the same thing is true of email.
And HR (Workday). And purchasing (Workday again).
Wordpress and cPanel are awesome (Score:2)
....if you want this sort of garbage
Maybe ignoring the critical update advice was a bad decision?
Re: (Score:2)
I could be wrong, but I have to go into Canvas every once in a while... and it feels more like one of those Angular / React type single-page-on-top-of-a-Javascript-framework sort of web apps.