Tens of thousands of New Zealand university students have had their personal details swept up in a global hack of the learning platform Canvas, leaving lecture materials and assignment portals locked across the country and a hacker group demanding payment by Tuesday 12 May.
The University of Auckland, the Auckland University of Technology and Victoria University of Wellington all use Canvas, the cloud based learning management system run by United States software company Instructure. Around 9,000 schools and universities around the world rely on it, including Harvard, Stanford and the University of California Berkeley.
Students logging into Canvas on Thursday morning were met not with their course pages but with a message from a hacker collective calling itself ShinyHunters. The note claimed the group had breached Instructure for a second time and that the company had ignored their earlier contact. They warned that names, email addresses, student identification numbers and private Canvas messages had been copied off Instructure’s servers and threatened to publish everything unless schools negotiated a settlement before the end of Tuesday 12 May.
Canvas was taken fully offline on Friday 8 May while Instructure’s engineers worked on the incident.
The University of Auckland’s chief digital officer Jason Mangan confirmed the disruption in a statement to staff and students, saying Canvas was offline and stressing that the breach was not at the university itself. “This is not a breach of the university’s systems, and no other systems are at risk,” he said. The university also confirmed that the compromised data potentially included names, email addresses, student ID numbers and Canvas messages from both past and current users, but said there was no suggestion that any student assessment data, passwords or single sign on credentials had been touched.
Victoria University vice chancellor Nic Smith struck a similar note, saying “Our priority is protecting the security of student and staff information.” He confirmed that in person teaching and the wider university timetable would continue as normal during the outage.
AUT’s information and communications technology team has been working alongside Instructure and has asked all staff and students to log out of Canvas while the platform is investigated. The Auckland university has also told course coordinators that no assessments will be required while Canvas is unavailable, with extensions offered in line with the length of the outage, according to RNZ.
Instructure has confirmed that the data taken from its servers includes names, email addresses, student ID numbers, Canvas inbox messages, course enrolments, grades, assignment submission records and general course activity. The company says it does not believe birth dates, passwords, single sign on credentials, government identifiers or any financial information have been compromised.
That has not slowed concern on campus. One engineering student in Auckland told the New Zealand Herald that his main worry was the exposure of personal information rather than the assessment delays. A Bachelor of Commerce student told the same paper that much of the exposed data was already easy enough to find online, but that she was rattled at being locked out of her course materials halfway through the semester.
The timing is awkward. Mid semester tests and assignment due dates fall in the second week of May at all three New Zealand universities, and many courses now host their reading lists, lecture recordings and discussion forums entirely inside Canvas. Auckland has pointed students toward alternative platforms it operates locally, including Talis for reading lists, Panopto for lecture recordings and Inspera for some online tests. Victoria and AUT have told students to wait for further direction from individual course coordinators.
ShinyHunters is one of the more active extortion groups in the cyber crime ecosystem, and has previously been linked to data theft at large consumer brands and at telecoms companies. The group says it gave Instructure a chance to pay following an earlier intrusion and that the company instead quietly applied security patches without responding. As Inside Higher Ed reported earlier this week, the same crew has now reappeared with a fresh extraction of student records and a public deadline. None of the three affected New Zealand universities has commented on whether Instructure intends to negotiate.
The other immediate risk is phishing. With a fresh list of valid student names, university email addresses and student ID numbers, criminals can craft convincing fake messages that pretend to come from a tutor or the IT helpdesk. The University of Auckland is urging students to be wary of unexpected emails, particularly any that ask for personal information or push for urgent action, and to report anything suspicious through the university’s official IT channel rather than replying directly. AUT and Victoria have issued similar phishing warnings.
For now the advice is practical. Students should change any password that they had reused on Canvas elsewhere, even though Canvas passwords themselves are not believed to be in the leak. They should treat any email referencing their Canvas account with suspicion and verify it through a second channel. And they should keep checking their university’s notice page rather than relying on Canvas itself for updates, because the platform may remain offline for several days.
Instructure has not given a firm date for when Canvas will be restored, nor has it said publicly whether it will engage with ShinyHunters before the 12 May deadline. The Office of the Privacy Commissioner has not commented on whether it has received a formal notification under the breach reporting regime, but the threshold for a notifiable privacy breach is comfortably crossed for any New Zealand university whose students appear on the leaked list.
If you are a student affected by the Canvas outage and want to share your experience, or if you have a view on how universities and overseas software vendors should handle these incidents, please leave a comment below.
This article was written by AI, briefed to report the facts, hopefully without some of the bias people bring to the job 🙂
Leave a Reply