Global Cyberattack Disrupts New Zealand Universities, Exposes Student Data A widespread cyberattack targeting Instructure, the third-party provider behind the Canvas learning platform, has left thousands of students and staff across New Zealand unable to access course materials, submit assignments, or communicate with tutors. The breach, which also impacted U.S. universities including Harvard and Stanford, has raised concerns over the exposure of sensitive student data. ### Key Details of the Incident - Who was affected? Universities in New Zealand including the University of Auckland, AUT, and Victoria University of Wellington as well as institutions in the U.S. reported disruptions. - What was compromised? While universities confirmed their own systems remained secure, the breach exposed names, email addresses, student ID numbers, and private messages exchanged on Canvas. No passwords or assessment data were reportedly accessed. - When did it happen? The attack surfaced on Thursday (May 9), with universities scrambling to implement workarounds by Friday (May 10). - Why did it happen? The hacking group behind the attack claimed Instructure had previously ignored their demands, prompting the breach. They threatened to release stolen data by May 12 unless affected institutions negotiated a settlement. ### Impact on Students and Institutions - Disrupted learning: Students like Tyler Jones from the University of Auckland faced delays in accessing lectures, readings, and assignment materials, with some assessments canceled or extended. - Privacy concerns: While many students dismissed the risks, experts warned that exposed messages could contain sensitive personal information. - University responses: AUT and the University of Auckland advised staff to log out of Canvas and assured extensions for affected assignments. AUT confirmed no submissions would be required while the platform was down. ### Global Reach of the Attack Canvas is used by 9,000 education systems worldwide, making this one of the largest recent cyber incidents targeting academic institutions. The hackers’ message, visible to users attempting to log in, accused Instructure of failing to address prior vulnerabilities, escalating the breach into a ransom-style extortion attempt. The full extent of the data exposure and the hackers’ next moves remain unclear as institutions assess the fallout.