Canvas outage delays college finals across the country
Add Axios as your preferred source to
see more of our stories on Google.
Illustration: Brendan Lynch/Axios
Universities across the country are rescheduling or canceling finals after a cyberattack shut down a learning platform used by thousands of schools for course information and assignments.
The big picture: The attack comes at a critical moment for college students who are cramming for finals — and underscores education's growing reliance on singular technology platforms.
Driving the news: With caps and gowns already purchased at campuses across the country, several universities announced that the shutdown forced them to reorganize or scratch finals.
- Penn State announced that Thursday night and Friday exams had been canceled. Administrators are working with faculty to determine what that means for final grading. Students can still walk at graduation even without their finals grades, the university said.
- Boise State University also canceled Friday's final exams. Mississippi State opted to reschedule Friday exams for Saturday.
- UT San Antonio postponed assignments and exams to a "near future date," and James Madison University pushed Friday morning exams to Wednesday.
Catch up quick: Instructure, Canvas' developer, said that "unauthorized activity" was first detected in late April, but that it "immediately revoked" that unauthorized party's access.
- But on Thursday, an "unauthorized actor" made changes to Canvas pages, forcing the education tech giant to take the site offline. Personal information like names, email addresses, student IDs and messages appeared to have been breached.
- The Harvard Crimson reported that students accessing the Harvard Canvas site on Thursday were redirected to a message from cybercriminal hacking group ShinyHunters that claimed it had "breached Instructure" and posted a list of affected schools.
- On Friday, Instructure said Canvas was back online. The company said hackers exploited an issue with Free-For-Teacher accounts, which it has since shut down for now.
Our thought bubble: Axios' cybersecurity reporter Sam Sabin says hackers are opportunistic and frequently target central providers whose compromise can ripple across an entire sector.
- In this case, the target was Canvas — and the more than 8,000 organizations that rely on its services.
Catch up quick: The hacking group that claimed responsibility has reportedly also gone after Ticketmaster, AT&T and other education-related companies.
Go deeper: PowerSchool says it paid ransom in December cyberattack
