Around 1 p.m. on May 7, the final Thursday of classes before finals begin at CSUN, Canvas experienced a cybersecurity breach. Students currently are unable to access their classes, exams and assignments.
Until around 1:45 p.m., opening the desktop webpage displayed a message from the hackers that threatened to leak all sensitive information to the public unless individual schools reach out to “negotiate a settlement.”
After 1:45 p.m., that message was replaced with an error message stating that Canvas is undergoing scheduled maintenance. The Canvas mobile app also shows various error messages.
According to Instructure, the parent company of Learning Management System, Canvas, is used by more than 50% of higher education institutions across the country. That amounts to an estimated 9.64 million students impacted in this breach.
On May 6, Instructure posted an official incident report claiming that there had been a cybersecurity attack compromising the sensitive data of students.
“Instructure recently experienced a cybersecurity incident perpetrated by a criminal threat actor.” Instructure Chief Information Security Officer Steve Proud said. “We are working quickly to understand the extent of the incident and actively taking steps to minimize its impact.”
At 1:15 p.m. on May 6, Instructure claimed that the threat had been minimized and Canvas was fully operational. CSUN Information Security Officer, Kevin Krzewinski, sent out an alert to CSUN students reiterating Instructure’s statement and urging students to remain vigilant.
Instructure has not confirmed what data may have been susceptible in this event, but claims that Canvas does not store passwords, Social Security numbers, financial information or dates of birth. The hackers claim to have access to student names, personal email addresses and Canvas messages.
The hacking group who claims responsibility for this cybersecurity breach is called ShinyHunters. According to Bug Crowd, a crowdsourced cybersecurity website, “ShinyHunters is a threat actor group that became prominent in 2020 with their purported data theft of 200+ million records stolen from 13 companies.”
At this time, it is unclear what actions the CSU system is taking in regards to mitigating this issue, restoring access to students and securing their sensitive information. The Canvas webpage is inaccessible, showing only the hackers message, while the mobile app shows various error messages.
The greater impact of the data breach remains to be seen as does the next week of final exams, assignments and projects for CSUN students.
Editor’s note: this article was last updated at 2 p.m. on May 7.
