University Students Struck by Cyber Breach

Abbie Gargett reports on the major cybersecurity breach that shut down education platform Canvas in universities around the world

On May 5, Canvas shut down its services due to a major cybersecurity breach, impacting thousands of students across Swinburne University, the University of Melbourne, RMIT (Royal Melbourne Institute of Technology) and over 9,000 other institutions worldwide.

According to public statements from the universities, the hackers accessed the names and emails of students and as soon as the institutions were made aware of this, the site went offline, shutting out all users.

The platform, developed and published by Instructure, is widely used to distribute and manage educational resources, assignments and online classes. Its closure significantly impacted the universities’ ability to run their courses, resulting in a variety of responses from each institution.

According to a general email sent to students, Swinburne University delayed most classes for one week, explaining in an email, “we have made this decision to make sure that students who rely on Canvas as part of their studies are not disadvantaged academically while the platform remains unavailable.” The university has a heavy reliance on Canvas for online and blended learning, with Deputy Vice-Chancellor Professor Laura-Anne Bull communicating the critical information to staff and students.

Despite the major disruption, first-year student Tyler Stokes was not concerned. “Personally, I love it, because I get to catch up on all the work,” he said. “I thought it was a great decision… I was vaguely stressed, but I also knew that it's not really my fault.”

According to their respective websites, Melbourne University and RMIT both continued to run classes despite the shutdown, opting to just give their students an automatic assignment extension until May 15. Melbourne University master’s student, Sylvia Hedt, said, “I wasn't too stressed because I'd already applied for an extension prior to the breach.” However, she was critical of the lack of communication from individual lecturers throughout the crisis. “It didn't impact my studies too much, but I do know of a lot of other people in the course who were quite distressed by the breach and the lack of clear communication.”

First-year RMIT student Joel Packett also acknowledged some frustration at slow communication from his university. “I think for the most part, the Uni was as clueless as we were so, yes, the steps they took were pretty understandable, however I would have liked communication to come a bit quicker over the weekend.”

Both Packett and Stokes were not too worried about their personal cybersecurity during the breach. Packett said, “I didn’t really feel scared at all. It was clear from what we knew that this information was pretty tame.” Stokes added that his lack of concern came from his belief that his personal information was likely already available online everywhere. “My email, I don't really care about,” he said, “and private messages, I don't have any. So, I really don't care about my data being leaked.”

According to a May 8 email statement to Swinburne students, “Instructure has reached an agreement with the unauthorised actor involved in the incident to have data returned and is conducting a comprehensive review.” Instructure have not disclosed the details of this deal, but other reports have alleged a ransom around USD$10 million was paid to notorious hacking group ShinyHunters, and the platform was back online later the same day.