ShinyHunters defaces Canvas login pages, disrupting universities including in Canada
The ShinyHunters extortion group replaced Canvas login pages with a ransom message on May 7, forcing Instructure to put its widely used learning platform into maintenance mode and disrupting universities and colleges in Canada and at least eight other countries during final exams.
Canvas is used by more than 8,000 institutions and has about 30 million active users. The defacement came days after Instructure disclosed that the same attackers had stolen names, email addresses, student ID numbers and messages between users.
What happened
Instructure says it detected unauthorized activity in Canvas on April 29 and revoked the intruder's access. It disclosed the incident on May 1 and said the next day that it was contained. ShinyHunters posted a ransom note on May 3, claiming 3.65 terabytes of data on about 275 million users across 8,809 institutions, figures that have not been independently verified, according to ITPro.
On May 7 the group used a second Canvas weakness to change pages shown to some students and teachers. Instructure's incident page says the attack was disabled about 10 minutes after it began and that no additional data was taken. The company traced both intrusions to its Free-for-Teacher accounts, which it has since discontinued. Some schools kept Canvas offline for days, and outages were reported in the U.S., U.K., Canada, Australia, New Zealand, Sweden, the Netherlands, Hong Kong and Singapore.
Instructure said it found no evidence that passwords, dates of birth, government identifiers or financial information were involved.
The ransom agreement
On May 11 Instructure apologized for its lack of transparency and said it had reached an agreement with the threat actor under which the data was returned and the company received digital confirmation that it was destroyed. It said it was told no customers would be extorted. The terms were not disclosed. Reports of a payment amount remain unconfirmed.
What to do
Students and staff should expect phishing that refers to course names or Canvas messages and should not reply to anyone claiming to hold their data. Institutions should confirm their designated security contacts with Instructure to receive notices about which records were involved.
