Infamous hacker group known as ShinyHunters have breached the online classroom platform known as Canvas giving them access to millions of messages and data on schools putting all effected schools at an extreme safeguarding risk. Instructure have confirmed that the data of over 275 million users was being held at ransom by the group.
The group have gained their notoriety over the years through attaching themselves to major data leaks and breaches, such as the major data breaches of the popular children’s online platform Animal Jam and the telecommunications company Telus & Telus Digital. This is not their first time hacking within the education sector however as they reportedly hacked the mathematics app Mathway and stole the information of 25 million users on the app.
Logo for Canvas, the hacked website
The shocking thing about this situation is that they have now reportedly hacked the platform twice, they have stated that they first hacked Canvas on May 1st and after Intrastructure only used some basic security fixes, they hacked them again, now ransoming the individual schools rather than the company. Schools had until May 12th to contact the group and reach a settlement or else all their stolen data was to get leaked on the dark web.
They made it clear that they would not back down from their threat of extortion which means the data of millions of students was in danger which can cause long costing damage in the long run for them such as being targeted for identity theft and potentially blackmail. Schools are suggested to move away from the platform so their data can be more secure and their students better safeguarded in case of further negligence from the company, they are also advised to check the list to make sure they were not on it, and to contact the authorities if they were.
If you feel as if your school is under attack please contact law enforcement and any other relevant authorities, and if you want expert consultation about the cyber security of your school then feel free to contact us here.
About the author: This post was written by Carwyn Kelly, a student on the CyberSafeSchools Academy virtual work experience programme. The Academy provides secondary school and college students with structured, hands-on experience in cybersecurity and digital marketing. Find out more about the Academy →