Canvas hack impacting New York, New Jersey schools, universities amid finals season

A cyberattack on a system used across the country affected thousands of students in the Tri-State Area amid finals season. 

A company called Instructure was hacked by a group called ShinyHunters Thursday. Instructure is behind the learning management system called Canvas, which thousands of students and teachers rely on.

The platform is used to manage grades, course notes, assignments and lecture videos.

New York City Schools Chancellor Kamar Samuels released a statement Friday about two privacy issues school officials learned about. One is impacting up to seven schools, and one is local to one campus, he said.

“New York City Public Schools places a premium on the protection of student data and use of technology, and devotes significant resources to doing so. In line with that, we act quickly and urgently when we learn of a potential breach,” Samuels said. “In such cases, we work around the clock with any vendor that may be involved, as well as all appropriate law enforcement agencies and NYC Cyber Command to drive towards resolution and safeguards as soon as feasible.”  

ShinyHunters said they gained access to student names, emails, ID numbers and private messages.

Cybersecurity experts say anyone who may have been compromised should change their password for Canvas and their bank accounts. They also advise being vigilant of phishing scams and monitoring credit scores. 

What schools are affected by the Canvas hack? 

Columbia University officials posted on social media that they are investigating after widespread issues were reported. The Mailman School of Public Health at the university postponed all exams and assignments due Friday.

Rutgers University also released several updates throughout Thursday night. 

“We are actively monitoring the global system outage impacting Canvas. Each campus will share communications with students, faculty, and staff, providing campus-specific information regarding exams and coursework,” the latest statement said. 

Is Canvas back up yet? 

A status log posted by Instructure said that the system is available for most users. 

It says Canvas Beta and Canvas Test are still in maintenance. 

A spokesperson from Instructure said Canvas is “now fully back online and available for use.”

The spokesperson said the company found an unauthorized actor involved in a security incident that was making changes to Canvas. 

“Out of an abundance of caution, we immediately took Canvas offline to contain access and further investigate. We have confirmed that the unauthorized actor exploited an issue related to our Free-For-Teacher accounts. As a result, we have made the difficult decision to temporarily shut down our Free-For-Teacher accounts,” the statement read.