It’s finals week at Indiana University, and instructors are unable to enter grades or view some submitted assignments.
A hacker group known as ShinyHunters infiltrated Canvas, a learning management system used by IU and hundreds of other American schools.
Students and staff attempting to access the platform received a message from the hackers threatening to release user information if the affected schools refuse to negotiate a settlement by May 12. The message included a link to the hackers’ site, accessible only through the TOR browser.
At 5:45 p.m., IU's University Information Technology Services sent an email to campus saying, "Canvas is experiencing a global outage that affects Indiana University and other educational institutions. More updates and instructions will be shared as they are available."
A message sent to students in the Luddy School of Informatics, Computing and Engineering said, "Evidently, with perfect timing for the semester, there has been an attack on canvas. ... If you logged into it today, it is possible your credentials / account may be compromised."
An IU spokesman said only that information will be shared as it becomes available.
Instructure, the company behind Canvas, said yesterday that names, email addresses, student ID numbers and user messages were found to be compromised but found no evidence that passwords, dates of birth, government identifiers or financial information were leaked.
The University of Colorado Boulder issued an outage report at 4:15 p.m. ET saying “Canvas is unavailable, and the webpage temporarily displayed a message regarding a security breach of Canvas."
The Harvard Crimson student newspaper reported, "Both the Canvas mobile app and the web platform were inaccessible to Harvard users as of 4:30 p.m."