A cyberattack has thrown thousands of schools and universities into disarray as students prepare for final exams, highlighting the education sector's reliance on digital platforms.
Attack Details
The hacking group ShinyHunters claimed responsibility for the breach at Instructure, the company behind the widely used learning management system Canvas, according to Luke Connolly, a threat analyst at cybersecurity firm Emisoft. Instructure has not yet responded to requests for comment regarding whether the system was taken offline as a precaution or due to the attack.
Connolly stated that the group posted online that nearly 9,000 schools worldwide were affected, with billions of private messages and records accessed. Screenshots provided by Connolly show that the group began threatening to leak the data on Sunday, with deadlines set for Thursday and May 12, suggesting ongoing extortion negotiations.
Impact on Education
Schools are prime targets for cybercriminals due to the wealth of digitized data they hold. Past attacks have hit Minneapolis Public Schools and the Los Angeles Unified School District. Canvas is used to manage grades, assignments, lecture videos, and more, making its outage particularly disruptive during finals season.
Connolly noted similarities between this breach and a previous attack on PowerSchool, another learning management provider, in which a Massachusetts college student was charged. ShinyHunters is described as a loose affiliation of teenagers and young adults based in the US and UK, also linked to attacks on Live Nation's Ticketmaster.
Institutional Responses
Universities and school districts have been notifying students and parents. The University of Iowa's IT director called it a "national-level cyber-security incident," while Virginia Tech acknowledged the impact on final exams. Harvard's student newspaper reported the system was down there as well. In Spokane, Washington, officials reassured parents that no sensitive data appeared to be compromised.
