Canvas breach forces U of T, UBC and U of Alberta to shut learning platforms
Several of Canada's largest universities shut down access to their online learning systems in early May after a breach at Instructure, the U.S. company behind the Canvas platform, escalated into a public extortion campaign.
The University of Toronto, the University of British Columbia and the University of Alberta were among the largest Canadian institutions affected, The Globe and Mail reported. Simon Fraser University, OCAD University, Ontario Tech University and Mohawk College also issued notices or confirmed disruptions.
What happened
Instructure said it first learned of the incident on April 29 and notified users on May 1. It said the data involved included names, email addresses, student ID numbers and messages between users, and that it found no evidence that passwords, birthdates, government identifiers or financial information were taken.
On May 7, students at U of T and elsewhere saw a message from the ShinyHunters group, which said it had breached Instructure, told schools to negotiate a ransom and set a May 12 deadline. Instructure said the attacker had changed pages some users saw by exploiting an issue tied to its Free-For-Teacher accounts, which it temporarily shut down, Daily Hive reported.
U of T suspended its Quercus service as a precaution on May 8. The University of Alberta took Canvas offline and told users not to log in, and UBC told students not to sign in until further notice and warned about phishing.
The deal
On May 11, Instructure said it had "reached an agreement with the unauthorized actor," Global News reported. The company did not say whether it paid, but said the data was returned, that it received digital confirmation of destruction, and that no customers would be extorted.
What we don't know yet
ShinyHunters claimed to have taken data on 275 million people from thousands of schools. That figure has not been verified, and the number of affected Canadian students has not been published. Assurances from a criminal group that data was deleted cannot be independently confirmed.
What to do
Students and staff should expect Canvas-themed phishing, avoid links in unexpected messages about their courses, and turn on multi-factor authentication for their university accounts.
