A group of cyber hackers targeted Canvas Instructure and threatens to release personal data if they're not paid by end of day, Tuesday, May 12.
As BYU-Idaho students tried to log on to Canvas, they found a message from the hackers instead of their dashboard.
The hacker group ShinyHunters warned Canvas-reliant universities that all information would be released on May 12, unless a ransom is paid. They provided a text document with every university affected.
Canvas removed the threat within an hour and replaced it with a “down for scheduled maintenance” sign.
According to a Reddit forum, notable affected schools include:
- Arizona State University
- BYU-Idaho
- BYU Independent Studies
- BYU J. Reuben Law School
- BYU Pathways
- BYU-Hawaii
- College of Eastern Idaho
- College of Southern Idaho
- College of Western Idaho
- Ensign College
- Florida State University
- Harvard University
- Idaho College of Osteopathic Medicine
- Idaho Digital Learning Alliance
- Idaho Medical Academy
- Idaho School for the Deaf and the Blind
- Idaho State Board of Education
- Idaho State Department of Education
- Idaho State University
- LDS Seminaries and Institutes
- North Idaho College
- Oxford University
- Penn State
- Stanford University
- University of Idaho
- University of Texas at Arlington
- University of Tennessee, Knoxville
- Utah University
- Utah Valley University
This isn’t the first time ShinyHunters has targeted educational platforms. In December 2024, the hackers breached education software PowerSchool and demanded a $2.5 million ransom. According to Inforsecurity Magazine, PowerSchool paid the ransom in the best interest of its customers.
“We don’t know a whole lot. All we know is that Instructure, the parent company that owns Canvas, several weeks ago was hacked on their development environment,” said Mark Warner, director of Unified Support at BYU-Idaho. “Now they’re hacked on their production environment. I’m not sure how long it will be out, but somebody out there is targeting Canvas right now. That’s all we know.”
Director of Public Affairs Brett Crandall, said a statement will be issued to BYU-Idaho students through email.
Instructure has no notice on its website at this time. Efforts to reach Instructure corporate were unsuccessful.
At 1:59 p.m., Jaxon Smith, a freshman studying pre-nursing, opened Canvas to complete one of his psychology quizzes. Smith was surprised to see an error pop up on his screen.
“At first I thought it was a joke by my psychology professor because I was like ‘Oh, psychology, he’s probably messing with us,’” Smith said. “Then I tried to click on a different class, and it did the same thing.”
He found a message from ShinyHunters. The message detailed how Canvas personnel can contact the hackers to pay the ransom and provided a link to the website located on the dark web. Later, the message was removed and replaced with a “Down for Maintenance” sign.
According to Yahoo Tech, Instructure issued a statement two days ago.
“While our investigation continues alongside our outside forensics experts, at this stage we believe the incident has been contained.”
Communication Professor Christian Mawlam acknowledged the risks that follow in technology centered education.
“There’s always plenty to keep the faculty at BYU-Idaho busy. I will look at my existing materials and make sure that they are up to date,” Mawlam said. “We can even think about how we can incorporate a discussion about communication on security in some of our mass media and society classes. We do live in the electronic superage and these things are just par for the course.”
Canvas can only collect certain information from computers. Instructure, the parent website of Canvas, said that “names, email addresses, student identification numbers, and user roles (e.g., student)” are collected by the app. Other concerns can consist of personal information put into Canvas by the user. If a student or administrator has a phone number, personal descriptions, or links to social media, it might be compromised.
0 Comments