Global Cyberattack Disrupts New Zealand Universities, Exposes Student Data A widespread cyberattack targeting Instructure, the third-party provider behind the Canvas learning platform, has left thousands of students and staff across New Zealand unable to access course materials, submit assignments, or communicate with tutors. The breach, which also impacted U.S. universities including Harvard and Stanford, has raised concerns over the exposure of sensitive student data. ### Key Details of the Incident - Who was affected? Universities in New Zealand including the University of Auckland, AUT, and Victoria University of Wellington as well as institutions in the U.S. reported disruptions. - What was compromised? While universities confirmed their own systems remained secure, the breach exposed names, email addresses, student ID numbers, and private messages exchanged on Canvas. No passwords or assessment data were reportedly accessed. - When did it happen? The attack surfaced on Thursday (May 9), with universities scrambling to implement workarounds by Friday (May 10). - Why did it happen? The hacking group behind the attack claimed Instructure had previously ignored their demands, prompting the breach. They threatened to release stolen data by May 12 unless affected institutions negotiated a settlement. ### Impact on Students and Institutions - Disrupted learning: Students like Tyler Jones from the University of Auckland faced delays in accessing lectures, readings, and assignment materials, with some assessments canceled or extended. - Privacy concerns: While many students dismissed the risks, experts warned that exposed messages could contain sensitive personal information. - University responses: AUT and the University of Auckland advised staff to log out of Canvas and assured extensions for affected assignments. AUT confirmed no submissions would be required while the platform was down. ### Global Reach of the Attack Canvas is used by 9,000 education systems worldwide, making this one of the largest recent cyber incidents targeting academic institutions. The hackers’ message, visible to users attempting to log in, accused Instructure of failing to address prior vulnerabilities, escalating the breach into a ransom-style extortion attempt. The full extent of the data exposure and the hackers’ next moves remain unclear as institutions assess the fallout.

Global Cyberattack Disrupts Learning Platforms at New Zealand and U.S. Universities A widespread cyberattack has compromised Canvas, a widely used online learning platform, affecting universities in New Zealand and the U.S., including the University of Auckland, Auckland University of Technology (AUT), Harvard, and Stanford. The breach, attributed to a hacking group targeting Instructure, Canvas’s parent company, exposed names, email addresses, student ID numbers, and private messages between users. The attack forced Canvas offline, prompting universities to implement urgent workarounds to mitigate disruptions to teaching and assessments. While no passwords, sign-on credentials, or student assessment data were reportedly compromised, the hackers left a message in the system, demanding schools contact them by May 12 to negotiate a settlement or risk public data leaks. The group claimed Instructure had previously ignored their warnings and applied only superficial security fixes. At AUT, staff were instructed to log out of Canvas, and students were granted assessment extensions while the platform remained inaccessible. The University of Auckland confirmed its internal systems were unaffected but acknowledged potential adjustments to academic deadlines. Canvas is used by over 9,000 education systems worldwide, underscoring the scale of the incident. The breach highlights vulnerabilities in third-party education platforms and the growing threat of ransom-driven cyberattacks targeting academic institutions.

Cyberattack Disrupts Canvas Learning Portal at Major Universities Worldwide Hackers breached Instructure Inc.’s Canvas platform this month, forcing the company to temporarily suspend services for thousands of colleges and universities globally. The attack, detected on May 1, exploited a vulnerability in a teacher-specific account, granting unauthorized access to some of the company’s websites. While much of the service was restored by May 2, affected teacher accounts remain suspended. Canvas, a widely used learning management system, supports critical academic functions, including exams, assignments, and grade tracking. The outage impacted institutions such as Harvard, Princeton, Stanford, Yale, Columbia, the University of Oslo, and Australia’s Adelaide University, disrupting operations for students and faculty. The extent of data exposure remains unclear, though some universities reported potential breaches of user information. Yale warned that names, email addresses, and internal messages may have been accessed, while Stanford flagged possible exposure of student IDs and communications. Rutgers and Baylor noted uncertainty around compromised data, with Baylor cautioning about subsequent phishing attempts targeting students. The cybercrime group ShinyHunters claimed responsibility in a dark web post, though Instructure has not confirmed their involvement. Known for data theft and extortion, the group has previously targeted educational institutions, including a 2023 wave of attacks on Ivy League schools that exposed alumni and student records. Instructure, acquired by private equity firm KKR in a $4.8 billion deal earlier this year, was previously majority-owned by Thoma Bravo. The Salt Lake City-based company, founded in 2008, has not disclosed whether sensitive data was exfiltrated during the incident.