List of Pittsburgh colleges, universities impacted by Canvas hack
Canvas, a cloud-based learning management platform used by most Pittsburgh colleges and universities, was hacked on May 7 and down for hours, with students and teachers losing access to the platform and hackers claiming that they had accessed data from millions of users.
The incident was widespread, with the site down through the evening nationwide amidst finals.
Here's what to know, and which Pittsburgh area schools may be affected.
Is Canvas down? When will it be back online?
"Canvas is fully back online and available for use," Instructure said on its incident update page as of the morning of May 8.
The site came back online slowly, with Instructure saying in a post on its status page late May 7 that Canvas was "available for most users." The site was temporarily placed in "maintenance mode" while the company investigated the issue.
What is Canvas?
Canvas is an application that allows students and faculty to virtually upload assignments, grade coursework and complete exams.
Canvas has more than 30 million active users worldwide and over 8,000 institutions as customers, according to USA Today.
What Pittsburgh universities and colleges were impacted by Canvas hack?
These colleges and universities with campuses in Pittsburgh and the Greater Pittsburgh area use Canvas and may be impacted by the hack.
- Butler County Community College
- Carnegie Mellon University
- Duquesne University
- La Roche University
- Pennsylvania State University
- Pittsburgh Institute of Aeronautics
- Pittsburgh Theological Seminary
- Point Park University
- Seton Hill University
- Trinity Anglican Seminary
- University of Pittsburgh
- UPMC Schools of Nursing
Who hacked Canvas and why?
Hackers gained unauthorized access to Canvas by "exploiting an issue related to our Free-For-Teacher accounts," Instructure said. Free-For-Teacher accounts have been temporarily shut down as a result, the company said.
The company first became aware of the hackers' presence on April 29. On May 8, the same actor "made changes to the pages that appeared when some students and teachers were logged in through Canvas," causing Instructure to take Canvas offline to investigate.
A group called ShinyHunters claimed responsibility for the hack, according to USA Today. It said that anyone who did not want their data released should contact the group before May 12.
A screenshot depicting a similar message was shared in the University of Cincinnati subreddit on May 7 with the caption "Anyone else seeing this? I can't do anything on web or mobile."
As of May 8, Instructure said it has found no evidence that "passwords, dates of birth, government identifiers, or financial information" were involved in the data breach. However, it said "names, email addresses, student ID numbers, and messages among Canvas users" were accessed by hackers.
Who are ShinyHunters?
ShinyHunters has a history of compromising global corporations, according to Reuters. In April, the hacking group said it had stolen nearly 80 million business records from video game developer Rockstar Games, the maker of Grand Theft Auto.
ShinyHunters said it had accessed data from over 275 million people — including students, teachers, and other staff — across nearly 9,000 schools worldwide, according to USA Today.