Instructure Puts Canvas in Maintenance Mode While Investigating Data Breach

Instructure placed its Canvas, Canvas Beta and Canvas Test environments in maintenance mode late Thursday afternoon while it investigated a claimed intrusion, according to a notice posted on the company’s website. ” The message included a link to a list of schools the group claims to have accessed through Canvas.

Canvas is a cloud-based platform used by more than 30 million active users and more than 8,000 institutions globally. Universities including the University of Pennsylvania, Georgetown University and the University of Oklahoma reported the ransom note appearing on their Canvas homepages while students were in the middle of spring finals week.

Instructure said it contained a cybersecurity incident perpetrated by a criminal threat actor on May 1 and contained the situation the next day. The company has confirmed that user names, email addresses and student ID numbers were accessed in that May 1 incident. Instructure said last week that it deployed patches to enhance system security following the breach.

ShinyHunters’ data-leak site lists 9,000 schools and claims data belonging to 275 million students, teachers and other staff. The group has demanded ransom payments to prevent further data leaks. This is the second incident involving the group this month.