Education Platform Canvas Hit by Cyberattack, Partially Restored for Millions of Students

An education platform used by thousands of schools and universities has been partially restored after an international cyberattack caused widespread disruption as students prepared for final exams.

The hacking group ShinyHunters claimed responsibility for taking down the online education platform Canvas, developed by tech company Instructure. The group said it stole 3.5 terabytes of data, including names, email addresses, student ID numbers, and private messages, and threatened to release the data unless a ransom is paid by May 12.

Instructure's website on Saturday said Canvas is now "available for most users" and that no issues were reported that day. It remains unclear whether the ransom was paid.

The University of Sydney announced the same day that Canvas had been restored but remained "inaccessible to staff or students pending final checks." In Canada, the University of Alberta said Canvas was partially restored with "reduced functionality."

Affected countries include the United States, the Netherlands, Sweden, Australia, and the United Kingdom. According to Canvas, about 30 million people globally use the system, and the attack targeted nearly 9,000 organizations worldwide.

The Attack Came at the 'Worst Possible Time'

The U.S. Federal Bureau of Investigation (FBI) said in a statement on Friday that it was "aware of the service disruption" affecting learning systems, though it did not name Canvas. "This disruption has affected schools, educational institutions, and students across the country," the FBI said.

Al Jazeera reporter Phil Lavelle, based in Florida, said the hack could not have "come at a worse time" as many U.S. schools are in the middle of exam season. Institutions such as Penn State, Harvard, Illinois, Columbia, and Georgetown are "scrambling" to extend or adjust deadlines, he said.

The Harvard Crimson student newspaper reported that access to the platform was lost on Thursday, while the University of Cambridge also announced it had "temporarily suspended access" to Canvas on Friday.

Reuters reported on May 5 that the group posted saying Instructure "didn't even bother to talk to us" to prevent the data leak, and that their demands were "not as high as you think."

Who Is ShinyHunters?

The group is a global cybercrime organization founded in 2019. Over the years, they have claimed responsibility for various cyberattacks, most recently the data breach at Rockstar Games, the company behind the Grand Theft Auto franchise.

"This shows just how vulnerable schools and institutions are to those seeking to exploit or extort at the worst possible time – with just a keyboard and mouse," Lavelle said.