A cyber attack hit several universities and schools in the US, Canada, and Australia, causing chaos, confusion, and major disruptions amid the high-stakes end-of-year season.
The hacking group ShinyHunters claimed responsibility for the attack, which caused the academic software Canvas used by thousands of schools and universities to go offline this week.
By late Thursday, the company Instructure, which owns Canvas, posted an update on its website saying that Canvas was “available for most users”, but some universities were still reporting outages on Friday.
The cyber attacks targeted universities and schools across the globe, affecting an estimated 9,000 institutions.
A ransom note demanding payment in bitcoin appeared on screens during a cyber-hacking incident on the cloud-based platform Canva.
Mississippi State University announced that it was postponing Friday’s final exams to allow affected students to recover any lost work.
Aubrey Palmer, a meteorology student at the university, told the BBC students had just finished a 2,900-word exam essay when a ransom note suddenly appeared on their screens.
The message read: “Shiny Hunters has breached Instructure (again).”
It threatened to release stolen data unless Canvas or the affected universities paid a ransom in bitcoin.
“My knee‑jerk reaction was that I’d been hacked myself, because that’s what it looked like,” Palmer said. “But then I actually read the ransom note and saw it was Canvas that had been hacked.”
Palmer said the professor and dozens of other students all had the note and everyone was looking around the room in confusion.
At first, it was unclear whether their work had been saved.
Frustration quickly spread among the students, and Palmer said people became “so angry at the idea of having to redo” their exams.
The university has since been updating students by email, rescheduling exams, and advising them to ignore suspicious messages while responding to what it described as a “nationwide security incident”.
“We are one of approximately 9000 institutions around the world that are impacted by this outage, and we are still waiting for advice from Instructure,” the university wrote on its website.
The outage affected students’ coursework and examinations, the university said, acknowledging “how disruptive this is at a critical time in the semester”.
On Thursday, Idaho State University said it had cancelled exams scheduled after 12:00 local time (18:00 GMT).
Penn State University wrote in a message to students on Thursday that “no one has access” to Canvas, adding that a “resolution” was unlikely to arrive “within the next 24 hours”. The university cancelled some exams scheduled for Thursday and Friday.
In an update on Thursday evening, the University of British Columbia in Vancouver informed students that Canvas was “unavailable due to a cyber breach of its parent company, Instructure,” and advised them to log out immediately.
The University of Toronto also reported it was impacted by the breach, saying that “multiple universities were affected”.
Students at the University of California, Los Angeles, struggled to submit assignments online through the Canvas platform, and the University of Chicago, in Illinois, temporarily disabled its Canvas page after reports that it was targeted.
The Chicago Maroon, the university-led newspaper, posted a screenshot of a message from ShinyHunters that appeared to be seeking a ransom.
The message encouraged the university to contact the hacking group privately “to negotiate a settlement” and avoid “the release of their data”.
It was the same message that Northwestern University master’s student Jacques Abou-Rizk said he received after clicking a link in an email that appeared to be from a university administrator.
“I didn’t know what was happening,” Abou-Rizk recalled. “It’s a scary message to receive.”
He said the university addressed the issue on Thursday, sending a generic email, seen by the BBC, that said Northwestern was “monitoring an issue”.
The email stated the university did not have an estimated restoration time for Canvas and that other IT infrastructure had not been affected.
Abou-Rizk said he was still unable to access Canvas on Friday and has not heard from the university since.
“There’s definitely anxiety surrounding not only being able to complete my work and access the sites that I need access to on Canvas,” Abou-Rizk said. “But also just not knowing exactly what the threat is and how it might affect me.
