IT Brew // Morning Brew // Update

CYBERSECURITY

Emily Parsons

The school day was “a bit of a logistical nightmare” on May 8, according to Nikita Borisov, a professor of electrical and computer engineering at the University of Illinois Urbana-Champaign’s Grainger College of Engineering.

But it wasn’t your typical chaos: A cyberattack against widely used edtech platform Canvas locked college professors, high school teachers, and students out of assignments, messaging, video content, grades, and other classroom materials.

While the global downtime caused minimal disruption for Borisov (whose final presentations for students did not explicitly rely on Canvas, he said), some teachers had to figure out a plan when campus canceled exams on May 9.

Threat actors exploited a vulnerability related to the company’s “Free for Teacher” environment, according to a statement from Steve Daly, Canvas parent company Instructure’s CEO. The chief exec said the incident involved unauthorized access to ⁠information like usernames, email addresses, course names, enrollment information, and messages.

The hacking group ShinyHunters posted on their own site that they had stolen terabytes of data from Canvas linked to nearly 9,000 schools worldwide.

How to prepare for this kind of disruption.—BH

☕ Taking cybersecurity to school