The hackers had stolen usernames, email addresses and messages from Canvas, an education application used by about 9,000 institutions worldwide. The American company Instructure, the creator of Canvas, was told to pay the ransom by 12 May, or else the data would be made public. According to a announcement published on Instructure’s website, a deal has been reached and the stolen data has been deleted. Instructure has also apologised and said that Canvas is safe to use again.
Ransom
It has not disclosed whether the ransom was paid in exchange for the data being deleted. However, the hackers have confirmed a deal had been reached, NOS reported.
The hack also affected Dutch educational institutions. Seven universities, including Maastricht University, and at least two universities of applied sciences that use Canvas were affected. Students and teachers use the platform to communicate about education-related matters, such as assignments, deadlines, reading lists, timetables and grades.
Although UM sent an email last Wednesday stating that Canvas could still be used “safely”, a day later, this turned out not to be the case. The hackers had, in fact, made their presence known again on several Canvas websites. UM subsequently decided to disconnect all systems still connected to the application, effectively rendering Canvas unusable. Following “extensive checks, risk analyses, and tests,” according to an update on its website, UM relaunched the application Tuesday. Coincidentally, this coincides with the moment a deal was struck between Instructure and the hacker group.
The supplier has since confirmed that no sensitive data was stolen in Maastricht. This was reported at a University Council committee meeting today, May 13.
Inconvenient
A brief round of questions at various faculties in the city centre on Monday, 11 May, revealed that teachers and students feel the Canvas outage was mainly inconvenient. Assignments cannot be submitted, communication is only possible by email or group chats, and anyone who had failed to download the material in advance is out of luck. “We wanted to work on a group presentation, but we have no idea what it should be about,” said a second-year student of Economic Business Economics. One European Studies student had planned a study weekend, but on Friday evening, discovered she couldn’t access the course material. She emailed her tutor, but it was too late for a response.
Everything costs more time, various lecturers complained. “Students start asking all sorts of questions by email, including the feedback you had already provided on Canvas,” is the sentiment at the Faculty of Arts and Social Sciences (FASoS). And at the School of Business and Economics (SBE): “Communication is done by email, you have to download stuff, grades have to be recorded somewhere else... Canvas is just quicker.”
The FASoS lecturer found the situation was very confusing. “It is unclear what we as lecturers are supposed to do. You don’t want to make the situation worse. We mainly look to the course coordinators, but they are often very busy and also don’t know what to do. The university isn’t handling this crisis well. There is little information provided, and no reassurance, when those are both crucial in a situation such as this.”
Another SBE lecturer chuckled when asked about any problems. She teaches a large first-year class that doesn’t allow laptops in the lecture room. It is meant to aid concentration, and now has the unintended side effect that her teaching has not been disrupted: “They were all required to print a copy of the syllabus.”
There don’t seem to be any great concerns on Monday. The general feeling is that those will only arise if Canvas is still unavailable in a few weeks’ time. By then, exams will be just around the corner and final assignments due. That worry has now been allayed.
Observant/ HOP