As many might remember, recently Canvas was briefly hacked. While this didn’t necessarily cause a problem here at Liberty, it impacted a lot of people who had finals at the time of the hack, like those in college, other forms of higher education, or high school students outside of our district, as finals were earlier for some schools. But who hacked Canvas and why?
Canvas was hacked on May 7 by a group called ShinyHunters. The name of the group is alleged to be based on the Pokemon franchise, with shiny being a rare variant of Pokemon in the games.
The group first started their attacks in 2020, first hacking the site Mathway, an app that helps primarily students solve math equations. Though, the group has hacked multiple sites and services throughout the years, with the most notable (and sometimes confusing) being Wattpad, Microsoft, Animal Jam, AT&T Wireless, Pluto TV, Pizza Hut Australia, Ticketmaster, Grubhub, Panera Bread, and Rockstar games, with some other hacks having big names like Google, Louis Vuitton, and Dior involved. This large but nonexhaustive list shows that their hacks don’t necessarily follow a theme, instead the group trying to hack whatever can possibly cough up a ransom. Though, not all were hacked for a ransom, some were seemingly hacked to leak data just to leak data with no obvious financial motive.
In Canvas’ case, it was hacked to try and milk out a ransom from the company or any affected schools. It’s now been found out that Canvas knew about their systems being compromised days before the official take down of the site, but chose not to send out any sort of mass notice.
While it’s not clear if Canvas paid the ransom, it is speculated to be the case, as unlike other situations with ShinyHunters, there has been no mass upload of user information online (at least not yet).
What this hack shows is that convenience can come at a price, and the price in the case of Canvas is having a centralized hub for millions of user’s data, something valuable to hackers. To hackers, more data is just a larger payout, that be through ransom or by selling off user information.
What can be expected moving forward is possibly more attacks now that Canvas has allegedly paid off the hackers. The ransom money allegedly given only shows other groups that Canvas is willing to pay to keep them away. But for now, Canvas is back up and running.
