With technology becoming an increasingly ever-present part of our lives, schools have been relying on websites, like Canvas, to host online assignments and student information for years. Despite the convenience, these websites have a fatal flaw.

Full security on the web is nearly impossible. If any information about someone exists on the internet, it’s only a matter of time before it falls into the wrong hands.

The first breach occurred on May 1. In what is currently considered the largest educational security breach, Instructure, the parent company of Canvas, was hacked by a group known as ShinyHunters, and multiple terabytes of data was held for ransom. The data included personal information like student email addresses, names and private messages. Canvas claimed this breach was contained the next day.

According to a statement made on social media by Canvas, there was no evidence that passwords, dates of birth, government identifiers, or financial information were involved.

The hack was done using an exploit on Canvas’s Free-For-Teachers accounts, which have, in response, been made unavailable indefinitely.

Later that same night, Canvas was available for some users. 

On May 7, Instructure was breached again, and ShinyHunters set a ransom deadline for May 12.

Canvas is currently back online and operational. According to ABC, many universities had to postpone or cancel some finals due to the hack. As of May 11, Instructure has yet to issue an update on whether or not the ransom has been paid, or an update on the breached data.