ShinyHunters claims data theft from 8,800 schools (Instructure/Canvas)

SoftTalker•5 minutes ago

So many universities used to run homegrown or on-prem student systems. This is the downside of consolidating in the cloud. If the infrastructure is compromised, it affects everyone, not just isolated or single installations. I wonder how they are feeling about that decision now? I guess they can say "not our fault" so they might be feeling better than if it was a vulnerability in their own system.

exprez135•about 2 hours ago

The Canvas instance at the nearby university is now down (May 7, 4 PM Eastern), but was briefly displaying the message in this screenshot (1). The ransom message implies that today's problem is the second wave in an attack on Instructure after ignoring their first breach in recent days.

1: https://ibb.co/r29RjdnH

HDBaseT•11 minutes ago

Yeah, this is ongoing.

We received communication that Canvas is down for "Under Maintenance" although it seems ShineyHunters have compromised Canvas again with that message you posted.

We do not see that message anymore, although all instrucuture.com URLs are down. The list of schools in the ShinyHunters publication can be found here: https://web.archive.org/web/20260507042014/http://91.215.85....

tom1337•17 minutes ago

> Canvas is currently undergoing scheduled maintenance

doesn't seem that scheduled to me

incomplete•about 1 hour ago

yep, i work for a major university and our canvas instance is down. this is really, really bad.

edit: here's the list of impacted universities (unsure if they all have their canvas instances offline, but i'd be surprised if not): http://91.215.85.103/pay_or_leak/instructure_affected_school...

12_throw_away•16 minutes ago

I think we might be finding out that canvas "instances" may not be quite as isolated /segregated from each other as they're supposed to be.

wky•9 minutes ago

It's possible that Instructure's servers got compromised:

dig canvas.ucdavis.edu

    [...]
    
    ;; ANSWER SECTION:
    canvas.ucdavis.edu. 1974 IN CNAME ucdavis-vanity.instructure.com.
    ucdavis-vanity.instructure.com. 60 IN A 18.173.121.125
    ucdavis-vanity.instructure.com. 60 IN A 18.173.121.103
    ucdavis-vanity.instructure.com. 60 IN A 18.173.121.15
    ucdavis-vanity.instructure.com. 60 IN A 18.173.121.18

dig canvas.duke.edu

    ;; ANSWER SECTION:
    canvas.duke.edu. 300 IN CNAME duke-vanity.instructure.com.
    duke-vanity.instructure.com. 60 IN A 18.173.121.125
    duke-vanity.instructure.com. 60 IN A 18.173.121.18
    duke-vanity.instructure.com. 60 IN A 18.173.121.103
    duke-vanity.instructure.com. 60 IN A 18.173.121.15

bigfatkitten•about 2 hours ago

I use Canvas for some postgraduate studies, and my teenage daughter uses it at her high school.

We already bond over how awful the Canvas UX is (and she has a bunch of Chrome extensions to improve it.) Now we’ve got something else to gripe over together.

podiki•about 1 hour ago

And grades are due in the next week or so for many of these (usually a quick deadline at the end of the semester due to graduation happening)...

SoftTalker•13 minutes ago

Graduation is just a ceremony. The actual credential award depends on whether you finished all your coursework and is not time-boxed by that event.

Of course if you can't complete your exams because of this, that's more of an issue!

kristianp•about 2 hours ago

Qld, Australia was also affected: https://www.itnews.com.au/news/qld-gov-says-students-staff-c...

plasma_beam•about 2 hours ago

Our public school system here in Maryland got hit, ransom screen.

skeaker•about 2 hours ago

Pretty cruel to do this right around finals.

daledavies•about 2 hours ago

Eek I bet there are a few people at Instructure who won't be getting much sleep tonight!

krupan•about 2 hours ago

A college student I know just sent me a screenshot, he can't access canvas for his school at all

yesiamyourdad•about 2 hours ago

Same, my daughter just sent a screenshot, she was trying to study for finals.

ShinyHunters claims data theft from 8,800 schools (Instructure/Canvas)

⚡ Community Insights

Discussion (16 Comments)Read Original on HackerNews