How a Canvas hack forced chemists to communicate creatively

Amanda Holton was in the middle of a Zoom meeting of the online general chemistry class she teaches on Thursday, May 7, when the chat started “blowing up” with students saying they had lost access to Canvas.

“It was down for everybody,” Holton, a teaching professor at the University of California, Irvine, says. All the students could see on Canvas was a message from a group of hackers calling themselves ShinyHunters.

Canvas, the educational technology platform used by nearly 9,000 colleges, universities, and K–12 schools in over 100 countries, completely shut down for several hours on May 7 following a cyberattack. The platform technically came back online around 11 p.m. US Eastern time the same day, though many campuses did not restore full access until the weekend.

The impact depended on myriad variables, including the school’s academic calendar, the size and type of class, and individual instructors’ preferences for classroom technology. Ultimately, the incident prompted some clever problem-solving among chemistry educators, as well as a lot of reflection about the risks and benefits of centralized digital platforms.

Timing is everything

Danielle Jacobs, an associate professor at Rider University, uses Canvas as a repository for videos, practice problems, and other course materials for her 20-person organic chemistry lecture class. “It’s like a road map,” she says. “It’s where they go after a lecture or before a lecture to gather everything they need.” She also used it to collect and grade certain assignments.

Jacobs says that she was lucky enough to avoid being majorly impacted by the outage. Her class had their final exam on Thursday, so her students no longer needed access to study materials when the site went down. And her class was small enough that she could email the take-home portion of the exam to each of her students. But if Canvas had crashed earlier, or not been restored over the weekend, it would have been a bigger problem, she acknowledges.

Canvas’s issues actually began on May 1, when Instructure, Canvas’s parent company, reported a data breach. The stolen data included email addresses, student ID numbers, and messages among Canvas users. The company’s chief information security officer updated the incident report on May 2, saying that the incident had been contained, and again on May 6, pronouncing the breach fully resolved.

But the very next day, students and faculty attempting to log into Canvas were met with a stark black box containing a message from ShinyHunters, saying that they had once again breached Instructure’s systems. The message also threatened to leak the data the hackers had stolen if Instructure and the affected schools didn’t negotiate a settlement by May 12.

On May 11, the company posted an update to their public-facing page about the incident, saying that they had “reached an agreement” with the hackers, the stolen data had been returned, and no individual schools would be extorted.

Jacobs says that she suspects the hackers timed the attack to coincide with final exam season. Numerous students and teachers shared their panic and confusion in group chats and on social media. Many expressed concerns about how to submit or grade exams—and made references to the cyberattack storyline on The Pitt. But, “I think it was just an early reaction,” and many people’s fears didn’t end up coming to pass, Jacobs says.

Getting the message out

UCI is a large school and operates on the quarter system, so the Canvas outage hit the campus with learning in full swing.

“It’s been pretty chaotic,” says Renee Link, who oversees organic chemistry lab courses at UCI. “The ability for me, as the instructor, to communicate with everybody became a huge issue immediately.” UCI used to have email groups for each class, but about a year ago the university decided that all course announcements should be done via Canvas.

Link had to quickly figure out how to deliver updates and materials to over 1,000 undergraduates spread across 64 class sections, some of which were meeting at the time. Fortunately, she says, she was in a meeting with a colleague who runs the general chemistry labs when the shutdown began, and their software manager was right next door. They were able to put their heads together and troubleshoot.

“The thing that saved us is that we actually don’t build our [lab procedures] directly into Canvas. We use Google Docs,” she says. She sent Google links to all of her teaching assistants on Slack for them to pass to students. For course announcements, she used Gmail—which allows institutional users to send messages to up to 2,000 people at once.

Holton also relies heavily on Canvas as a central hub for course information. A lot of the materials are hosted elsewhere—Google calendars, Zoom links, videos on YouTube—but her students access the links to those materials through Canvas.

One of her classes was scheduled to have an exam administered on Canvas on Monday, May 11. The test, fortunately, went forward as planned. But it wasn’t clear when the weekend began if the issues would be resolved in time, she says, which caused some anxiety among students.

Her lifeline was the gamer-favorite messaging app Discord, which she started using last year as a digital proxy for office hours. When Canvas crashed, Holton emailed all 300 of her students and told them all that the app—which had previously been recommended but not mandatory—would be their new base of class operations.

“The Discord server wound up being just a giant group project of how can we recreate Canvas” based on the tabs people had open on their computers, she says. Ultimately, they recovered about 3 weeks’ worth of class material that way, she says.

Lessons learned

After the May 7 shutdown, Instructure issued a statement apologizing for the disruption and reassuring users that Canvas had been fully restored. But the situation sparked some serious conversations about how to back up crucial information and ensure it would remain accessible in case of future technical issues. There are so many factors “pushing kind of in a direction to do these digital things. But when these digital things collapse, what do we do?” Link says.

“I have to believe this kind of thing is going to happen more,” Holton says. She says she plans to start copying and pasting her weekly course pages into a separate Google document as a backup. “I can’t do quizzes, but that’s fine, everything else would be there.”

“It just makes me think of how reliant we are on the digital world,” Jacobs says. And the more reliant classes are on Canvas or any other single software, the more integrated everything is, the more vulnerable educators will be to technical problems. “I don’t think putting all of that in one place works.”