Canvas Learning Platform Disrupted by Instructure Cyberattack Affecting Thousands of Schools
Harvard and thousands of other schools faced disruptions to their Canvas learning platform after cybercriminal group ShinyHunters claimed a breach of parent company Instructure. The group claims to have stolen billions of private messages and is demanding ransom before May 12.
The Breach
Harvard students temporarily lost access to Canvas on Thursday afternoon after the cybercriminal group ShinyHunters listed the University among thousands of schools allegedly affected by a breach of Instructure, Canvas' parent company.
What Was Compromised
The message posted Thursday claimed the group had breached Instructure "again" and accused the company of ignoring its outreach by issuing small "security patches." It urged schools included on the affected list to consult with a cyber advisory firm and contact the group privately to negotiate a settlement before the end of the day on May 12 — or else risk their data being leaked.
Service Restoration
The site began displaying a message that read, "Canvas is currently undergoing scheduled maintenance. Check back soon." Both the Canvas mobile app and the web platform remained inaccessible to Harvard users through Thursday evening before access was restored around 2 a.m.
University Response
Harvard University Information Technology spokesperson Tim Bailey wrote in a statement Thursday that the University was "aware that the Canvas platform is currently unavailable due to a cyber incident" and that HUIT was "actively investigating" the breach.