Canvas down ahead of finals after Princeton data allegedly breached

Princeton’s course management platform Canvas went dark Thursday afternoon, just before the start of final exams, after the cybercriminal group ShinyHunters claimed to have hacked Instructure, the company that runs the site used by thousands of educational institutions.

Both the mobile app and the web platform were down for Princeton users as of 3:30 p.m. The outage comes less than 24 hours before the final assessment period starts and the first final assignments are due. 

Canvas remained accessible to Princeton affiliates through early Thursday afternoon before the site began displaying a message allegedly from ShinyHunters claiming that it would release data by May 13 unless individual universities negotiated a settlement. As of 4:30 p.m., the site was displaying a “scheduled maintenance” message.

Princeton and several thousand other universities appeared on a ShinyHunters list of institutions affected by Thursday’s data breach, which the group linked in its Canvas message. ShinyHunters claimed that it had “breached Instructure (again)” and that the company had not contacted the hackers to resolve the breach, instead implementing “‘security patches.’”

On Sunday, ShinyHunters announced it had breached Instructure, claiming to have obtained data from nearly 9,000 schools worldwide and 275 million people.

An Office of Information and Technology website, shared in a Thursday afternoon email, states that the University was affected by the breach, which possibly included names, email addresses, student ID numbers, and Canvas messages, though passwords and financial information were not believed to be involved. 

On Tuesday afternoon, Dean of the College Michael Gordin sent course instructors an email, which was obtained by The Daily Princetonian, asking them to download a copy of their Canvas gradebook as a “precautionary measure.”

A University spokesperson did not provide comment in time for publication. 

Nico David-Fox is a head News editor for the ‘Prince.’ He is from Washington, D.C. and often covers breaking news. He can be reached at ndf[at]dailyprincetonian.com.

Please send any corrections to corrections[at]dailyprincetonian.com.

This story is breaking and will be updated as more information becomes available.