Partial access to UChicago’s Canvas site was restored Saturday evening, ending an approximately two-day outage in the aftermath of an alleged data breach.
As of 6:54 p.m. on Sunday, Canvas’s mobile app remained inaccessible.
UChicago is “working with Instructure to better understand how University data may have been affected” by the security breach, Chief Information Officer Kevin Boyd wrote in an email to students on Saturday.
The criminal hacking group ShinyHunters claimed to have stolen sensitive UChicago account data from Instructure, Canvas’s parent company, in a message that briefly appeared on UChicago’s Canvas site Thursday. Instructors use Canvas to share assignments and resources with students in their courses. The group threatened to expose students’ personal information if UChicago or Instructure failed to “negotiate a settlement” with the group by May 12.
In an apology and FAQ, Instructure CEO Steve Daly wrote that the breach involved “information like usernames, email addresses, course names, enrollment information and messages,” but said no “core learning data (course content, submissions, credentials)” had been compromised.
UChicago was one of about 8,800 institutions included on a list of “affected schools” whose data ShinyHunters claimed to have breached. Other universities on the list, including Harvard University and Princeton University, also reported Canvas outages.
Boyd also said administrators are “aware of reports that users’ data in Canvas may have been compromised, and… are working with Instructure to better understand how University data may have been affected.” He added that the University “is actively monitoring for indications that cyber attackers are attempting to use exposed information for phishing and impersonation.”
