Ivy Tech restored access to the online learning management system Canvas on Friday, while Indiana University and the Monroe County Community School Corporation remained without the widely used service.
Thousands of schools rely on Canvas to enter grades, administer exams and share course materials.
But hackers brought down the site during finals week for IU, Ivy Tech and any number of other schools globally.
In a message to campus Friday, IU said, “While we are aware that a small number of institutions have seen Canvas functionality restored, our priority remains to restore service as soon as possible, while also protecting IU’s data security.”
Faculty have had to cancel or reschedule exams while finding new ways to make material accessible to students.
The situation is not quite as urgent at MCCSC, which still has almost two weeks left in the semester.
Isak Asare, Executive Director of the Cybersecurity Clinic at IU, was in the middle of grading final exams when the outage hit. He said only around eight of his 40 students had submitted their finals, and he was emailing them with alternative plans.
But problems abound for faculty and their classes.
“Even for people who might be still using blue books who have in-class finals, many of the students use Canvas to access slides, to get their study materials, to look at their past assignments,” Asare said.
Hackers identifying themselves with the group ShinyHunters claimed responsibility for the shutdown, which affected all schools using Canvas. They threatened to release user data unless schools paid them a settlement by the end of next Tuesday.
According to Instructure, the company behind Canvas, around half of college students in North America use the software and it has more than 8,000 customers in 100 countries.
The company also said Wednesday it found no evidence that passwords, dates of birth, government identifiers or financial information were involved, but IU told some users there was a chance their password was compromised if they accessed the site after 3:30 p.m. Thursday.
Asare studies cybersecurity and digital infrastructure. He believes the hack speaks to structural problems beyond the university.
“I think that we responded very quickly and also sent out communication to students very quickly, and we have policies already in place for these types of contingencies,” Asare said. “But it just highlights what happens in the digital age when we become increasingly dependent on singular tools, particularly when those singular tools are owned by third parties."
After IU shut it down yesterday, a message appeared saying Canvas was undergoing “scheduled” maintenance. That has since been amended to just say maintenance.
The university has guidance on what to do in case of a Canvas outage during finals week.
Ivy Tech restored its Canvas service Friday morning. CIO Sejal Vaishnav said the community college temporarily restricted access while it “assessed risk and confirmed the safeguards put in place by Instructure, Canvas’ parent company.”
Spokesperson Amanda Billings said approximately 1,000 students who had tests canceled that morning will be contacted later in the day with an update.
MCCSC also disabled its Canvas and Skyward services. The corporation told parents Friday morning it saw “no local evidence of accounts compromised.” It added that teachers will be flexible with students about assignments and grading.
Spokesperson Sarah DeWeese said nobody from MCCSC was available for an interview but added that she had not yet received confirmation from Infrastructure about whether student names, email addresses or messages were compromised.
DeWeese said birth dates, state testing numbers, passwords and student data outside of Canvas were safe.
Asare said all institutions, not just schools, will have to consider how to protect themselves and the populations they serve after becoming reliant on digital tools beyond their control.
“ We're building these really tall towers that are standing on shaky legs, and that's by and large what our digital infrastructure has become,” Asare said. “We saw this with the AWS outage some years ago. We saw this with the CrowdStrike issue some years ago. And I fear that this is gonna keep happening.”
