Canvas Gets Hacked and Goes Down

Hackers have begun a cyberattack against Instructure's Canvas, a cloud-based learning management system used at thousands of schools and universities. The outage could not have come at a worse time for students and teachers, three weeks before the end of the school year, right in the middle of final exams. There are questions about the security of customer data.

Much of American education was running on maintenance  

The major American universities were in trouble: Harvard, Columbia, Rutgers, Princeton, Penn State, UCLA, University of Wisconsin-Madison, University of Michigan, Northwestern, University of Chicago, University of Illinois Chicago, and the wider University of Illinois system, Georgetown, Kent State, Union College in New York, Duke, University of Maryland and Barnard College.  

Problems were also reported in K-12 districts in California, Florida, Georgia, Oklahoma, Oregon, Nevada, North Carolina, Tennessee, Utah, Virginia and Wisconsin. 

Penn State warned students that Canvas access may not be restored within 24 hours, and canceled previously scheduled tests. James Madison University moved its tests from Friday to Wednesday.  

The outage couldn't have come at a worse time for students 

Anish Garimidi, a University of Pennsylvania student, said it was stressful to lose study resources right before exams. Georgetown student Minhal Nazeer was home in Kentucky working on online projects, though the outage worked out for her: she got deadline extensions.  

Professors scrambled: some of them asked students to send assignments via email, others gave extensions. But for seniors already busy with end-of-year events, the loss of even a day of study time was still a sting. 

"The incident showed just how much classwork now depends on one cloud LMS platform," said Belitsoft CIO Dzmitry Baraishuk. "Without properly implemented security measures, a single hack can affect millions of students at once."

What Was Compromised

Instructure first reported the breach on May 1, though the attack actually began on April 30, when hackers exploited a vulnerability in its systems. 

CISO Steve Proud said forensics found that the stolen data included Canvas usernames, personal email addresses, student ID numbers, and messages between teachers and students. Passwords, birth dates, government IDs, and financial data weren't taken, the company said, and it's calling the incident a criminal attack. 

Instructure said it had contained the breach by May 2, and on Wednesday, May 6, declared Canvas fully operational after applying security patches. 

This was quickly shown to be false. By Thursday, the company's status page flagged login issues, and several of its platforms were placed into maintenance mode. Students were unable to access their ePortfolios, and other students encountered "Too many requests" errors when trying to access Canvas, Canvas Beta, and Canvas Test. 

Instructure's status page stated the incident was still unfolding, but service resumed for most users by Thursday evening. 

Soon after, hackers attempted to extort the company again by injecting malicious HTML into login pages. They broke into multiple schools' Canvas login pages and defaced the login screens. The defaced pages appeared on three school portals, according to TechCrunch, and Harvard's Canvas page was changed to show the list of affected schools and tell readers to contact the hackers. 

The modified pages claimed that hackers had gained access to Instructure's networks again, contradicting Instructure's statement that the last update had fixed the issues. 

The Ransom Threat

Hackers gave Instructure a deadline: if Instructure didn't come to the table, stolen data would be made public on May 12. The message named affected schools including Duke University and the University of Maryland, and urged them to bring in cybersecurity experts and lean on Instructure to negotiate. 

In a ransom note posted on a ransomware-tracking site, the group said they're ready to dump troves of private messages between students and teachers.

Instructure said the attackers exploited a vulnerability in its systems and stole API keys in the original April 30 break-in. When the hackers struck again a week later, defacing school login pages, the company said they got in through its Free-For-Teacher accounts, which it then shut down to contain the damage. 

Hackers also claim they broke into Instructure's Salesforce system and pulled more data from there. This is the second time hackers  have breached Instructure in eight months.

How Big Was the Breach?

The hackers said they hit nearly 9,000 schools worldwide, stealing billions of private messages and records. 

One report puts the figure of affected people at 231 million. Another says there are more than 275 million students, teachers and staff. 

None of these figures have been verified, and the actual total will not be known until the investigation is over.

The Bigger Picture

It wasn't surprising to see Canvas get hit. Cybersecurity researchers have warned for years that schools are an obvious target. They have grades, medical records, financial aid forms and personal details about minors but they spend a fraction of what banks or government agencies spend on defense. 

Minneapolis Public Schools, LA Unified, and PowerSchool all learned this lesson the hard way. Criminals have discovered that education pays.

Most of the education sector is dependent on a few vendors and gangs are becoming increasingly aggressive. If you target one platform, you take out thousands of schools.

The attack is part of a wider cybercrime problem that governments are still not taking seriously enough.

What Comes Next

Canvas is back up and available. The hard questions are not answered. Schools need to decide whether they want one vendor to have that much power. Someone needs to explain why assignments, grades, lecture recordings, private messages, and information about minors all exist in one place.