Instructure Canvas hack: Two times backdoor breach disrupts education platforms
The edtech giant Instructure, behind Learning Management Systems (LMS) like Canvas, faced two major security threats in recent weeks. On April 30, the platform went offline after a data breach involving over 275 million users across nearly 9,000 schools. A criminal group called ShinyHunters identified an exploited vulnerability in support tickets for Free for Teachers, leading to a temporary outage. However, just one week later, the same group breached school-specific login pages, defacing sites with messages threatening to release stolen data unless a settlement was reached.
ShinyHunters' ransomware-style attacks have been a recurring pattern, but this second incident raised concerns about the long-term risks of compromising institutional infrastructure. While Instructure temporarily disabled Free for Teacher accounts, the company acknowledged the disruption caused during finals and academic deadlines. A new incident page on their website highlights the vulnerability in support tickets—a detail that many educators find particularly concerning.
For many students, the downtime could have been devastating. Schools like Seton Hall University postponed final exams amid system issues, while Baylor University delayed its exams specifically due to access problems. Despite the temporary fixes, the settlement deadline for releasing stolen data remains looming, raising questions about the balance between security and student convenience.
This case underscores how technology can become a vector for exploitation when not properly secured. As PCMag reports, students and professors struggled to access critical tools during the disruptions, highlighting the importance of robust cybersecurity measures in educational environments. In a world increasingly reliant on digital platforms, these breaches remind us that vigilance is paramount—not just in protecting our data, but in safeguarding the trust we place in institutions.
