Hackers steal data of millions of students via Canvas, still unclear whether EUR is affected

In a cyberattack on education platform Canvas, hackers are said to have obtained the data of 275 million users. Erasmus University also uses the platform, but it is not yet known whether the data of EUR students and staff have been stolen.

In the attack, data of students, lecturers and education staff worldwide were obtained, such as names, email addresses, student numbers and possibly private messages. According to Instructure, the parent company of Canvas, no passwords, dates of birth, identity documents or bank details were stolen.

Still unknown at EUR

The university is still investigating whether its systems have been affected. Instructure has since taken additional security measures to limit further risks. As a result, minor disruptions may temporarily occur in Canvas. Students do not need to take any action themselves.

According to a spokesperson, EUR has had no direct contact with the hackers. Users were informed about the hack by email on Monday. As soon as there is more clarity, students and staff will be informed again via email and MyEUR.

Ransom

Instructure must pay a ransom by Wednesday at the latest, otherwise the hackers threaten to make the student data public. Worldwide, data of around 275 million Canvas users are said to have been stolen and some 9000 educational institutions may have been affected. In the Netherlands, in addition to Erasmus University, Fontys Universities of Applied Sciences, Maastricht University, HU University of Applied Sciences Utrecht, University of Amsterdam, Vrije Universiteit Amsterdam and Tilburg University use Canvas.

The hacker group ShinyHunters carried out the attack. Earlier this year, the group was also responsible for a data breach at Odido, in which data of millions of Dutch customers were obtained.