The learning platform Canvas went offline on Thursday after a nationwide cyberattack that jeopardized students’ personal data.
IUSD students and staff temporarily lost access to assignments, grades, instructional materials, and messages in Canvas during the afternoon outage until Instructure restored most access Thursday night. Stored student and teacher names, email addresses, messages and student IDs were compromised while sensitive home addresses, phone numbers, financial information and passwords were not, according to the district’s IT department.
“There’s definitely parts of information we don’t want some hacker group knowing,” freshman Ningxi Lu said. “With how big the incident was, we’re going to need more procedures to secure our information online.”
The hacker group ShinyHunters claimed on their website to be responsible for the breach of personal data from almost 9,000 districts, colleges and other schools nationwide, which was discovered by parent company Instructure on April 29. The group extended their initial Thursday deadline for a settlement from Instructure or affected schools to Tuesday by replacing Canvas’ login page with an extortion message, prompting Instructure to take the website offline.
The district has been in discussions with Instructure since May 1 and was notified of the breach on Tuesday, but is not planning to pay the hacker group, according to IT assistant superintendent Brianne Ford. Instructure has since disabled its Free-for-Teacher accounts, which it says were the source of the breach. The district paused updates between its IT systems and Canvas, including grade synchronization between Canvas and Aeries.
“Our focus remains on protecting our students, staff and systems; working with Instructure to understand the scope and impact of the incident; and taking appropriate steps to mitigate any additional risks,” Ford said in an email. “Our goal is to ensure students are supported and not negatively impacted by circumstances outside of their control.”
According to Ford, school administrators and teachers can determine how to address instructional disruptions. Some Northwood teachers responded by sending students agendas and instructional materials by email or delaying submission deadlines.
“It’s just kind of the nature of integrating online platforms into your daily teaching practice,” history teacher Brendan Geck said. “There’s a lot of benefits to using a platform like Canvas in terms of student communication and access to materials at home and all of this. But with that comes a risk, and you always have to know that that’s in the background.”
Some students also expressed concern over the timing of the outage during AP testing and near the end of the school year.
“After the AP test, I’ve been really backed up on some of my homework, and honestly I was going to cram a few,” junior Edward Jenks said. “And then I get on Canvas, and it’s just gone. So now, I feel like I’m going to have to get even more back up to date.”
Instructure has notified the FBI and U.S. Cybersecurity and Infrastructure Security Agency of the attack. Meanwhile, the district has encouraged families to be aware of potential phishing scams and to consider changing passwords. The district, Instructure and The Northwood Howler will continue to provide updates.
