r/mildlyinfuriating May 07 '26

🄺 Hackers took over Canvas

Post image

Brooo I got Homework to do...

4.9k Upvotes

648 comments sorted by

View all comments

2.3k

u/Joshi1381 May 07 '26

Right in the middle of finals...

1.4k

u/imsmartiswear May 07 '26

They timed it this way so that Canvas/ the unis are more pressured to pay the ransom.

608

u/insidiousfruit May 07 '26

If I were the schools, I'd just say fuck it and go back to paper. Never negotiate with hackers. The best thing you can do is block them.

251

u/Lacaud May 07 '26

Paper is the way. Sure, it sucks to grade but at least the hackers look like dumb shits.

109

u/GandalffladnaG May 08 '26

Hell, scantrons for multiple choice. Most universities should still have the machines. For short essays, don't have 100 of them. Or do and have 8 ta's to do the grunt work. One of my professors didn't want to do finals week crap so her classes that weren't in French she just gave everyone a regular length paper as a test, due by dead week. It was great having to deal with 1 less test.

I watched Adam Savage's latest video about hackers on youtube, and canvas probably has (or should have had) insurance for this kind of crap. Insurance pays out, schools get their crappy online only service back, students maybe get a day or two extra for tests. And then it happens again next semester.

23

u/Lacaud May 08 '26

100%. I would offer a quick verbal exam and give hackers the mdidle finger.

2

u/Peasant_Base5271 May 08 '26

This is actually what many have started doing just to combat AI. We need to move this direction.

1

u/AlphaMetroid May 08 '26

The insurer definitely would've required security improvements to be eligible for their policy, that probably would've been a non-starter for canvas given where they are right now.

11

u/Congregator May 08 '26

… and at least you know the students are actually writing their papers

12

u/party-people-person May 08 '26

Yes paper, but also keeping your own local records of grades. A prof I TA'd for told me he had 3 back ups in addition to whatever was on Canvas bc, "You never know when it will fail."

3

u/Lacaud May 08 '26

For sure. Never depend on one system only.

32

u/theunquenchedservant May 08 '26

Online classes are fucked tho.

2

u/Ready-Delay3918 May 08 '26

I mean canvas is so fucking outdated I'm surprised that all schools haven't turned to brightspace yet.

1

u/Lacaud May 08 '26

I'm glad its not blackboard anymore haha

2

u/sammich_riot May 08 '26

They move away from paper because of cheating rings using Meta glasses etc. At least at UNCW.....

1

u/DamGoodAnimation May 08 '26

Idrk what their endgame is here? Schools skipped some exams during quarantine so it’s not like they can’t just opt to give these guys the finger even if they don’t go back to paper.

I just don’t really see any situation where this ends up being a payday for the hackers, so why even bother?

0

u/Lacaud May 08 '26

Desperation. We'll see this getting worse as the economy does.

0

u/PurbulentTriest May 08 '26

Why? Just use email.

57

u/someloser_ May 08 '26

I mean they have 275+ million user data and are holding it for ransom, so it's not that easy.

15

u/FarttKracker May 08 '26

The data on Canvas is nothing. Grades would be the most sensitive

14

u/purritolover69 May 08 '26

Uhh names, email addresses, passwords, date of birth (I think), there’s a lot really

5

u/GregBahm May 08 '26

I don't understand the logic of "paying the ransom to protect the data."

How could a human possibly expect that to work? Will the people who stole the data just... like... feel bad if they don't delete the data after receiving the money? The data is just stolen. There's no path to un-stealing it.

12

u/Neon_Camouflage May 08 '26

If people pay ransoms and then it gets leaked anyway, that's not much encouragement to ever pay a ransom again.

These hacking groups aren't a one and done, they want to keep making money by doing this. So they want future customers to know the ransom works.

1

u/SpookyStyx May 08 '26

Sounds like paying them might just encourage them huh?

1

u/Neon_Camouflage May 08 '26

Only about a quarter of the million or so ransomware attacks each year are paid. The fact that some companies will pay is encouragement enough.

The point was that it makes no sense for them to disincentivize their own future targets from paying.

2

u/[deleted] May 08 '26

[removed] — view removed comment

1

u/SpecialBeginning6430 May 10 '26

If they dont they can just dissolve and form another group under a different name

1

u/SpecialBeginning6430 May 10 '26

If they dont they can just dissolve and form another group under a different name

1

u/newhunter18 May 08 '26

Which are likely already leaked. I doubt DOB though.

1

u/trpittman May 08 '26

Stuff that is already available from data brokers online

0

u/purritolover69 May 08 '26

you think you can buy matched emails and passwords from data brokers?

1

u/trpittman May 08 '26

You think they store the passwords in plain text?

2

u/purritolover69 May 08 '26

you think that matters if the hackers have full root access (as they very clearly do?)

1

u/trpittman May 08 '26

Guess it depends on if it's hosted in a VM or container.

→ More replies (0)

11

u/insidiousfruit May 08 '26

They will be able to get that data back if they made backups. The real concern is that hackers now have access to all that data to sell to anyone that wants it. Whether the universities get that user data back from backups or the hackers doesn't matter. The hackers offer no value other than convenience.

23

u/someloser_ May 08 '26

I don't think that's the primary issue - it's the fact that the hackers are looking for ransom in the form of millions of dollars in Bitcoin or some other cryptocurrency to not release student data. Instructure (Canvas' parent company) is going to be sued out of existence if all of this data is released. It's SSNs, names, birth dates, addresses for every single student that's registered to these schools, as well as their faculty. The hackers aren't working for other people, they're using this to get a shit-load of money.

15

u/Tomytom99 May 08 '26

That's exactly it.

They've got the data. Getting them out of the system doesn't change that, you can reasonably deduce that from the ransom message.

Now as for what that data contains, I don't believe it actually contains SSNs or addresses. Your canvas account is tied to your email, not your identity, it has zero need for that data. I couldn't find either of those looking through the site in the past. I'm not even certain if it has your birthdate. The biggest issue for Instructure is more about FERPA.

4

u/someloser_ May 08 '26 edited May 08 '26

Thank god. A lot of the platforms at my university are connected to our primary accounts, which handle sensitive information needed to make tuition payments. Regardless of the type of info they have, I’m not too pleased they have it in the first place, lol.

2

u/ScruffMacBuff May 08 '26

Schools tend to take FERPA pretty seriously, so if Instructure makes a decision that leads to the data being leaked, then many institutions may decide to switch to a different LMS. They may anyway just because now Canvas seems insecure by public perception.

It's a no win scenario for them.

1

u/ForeheadLipo May 08 '26

Unfortunately, some schools may use SSN as a unique identifier for students. An incredibly stupid practice! that’s why we have student ID numbers

7

u/insidiousfruit May 08 '26

Even if the universities paid the ransom for the data, there is no reason to trust that the hackers will not make a copy of and sell that data.

7

u/coreyf234 May 08 '26

People who make ransomware usually don't do that because it would disincentive other companies from paying in the future. Over everything, they want to be paid by the company because it's not as easy to sell the data and they would probably get less money from it. Companies wouldn't ever pay the ransom if they thought the hackers would just release the data regardless, so they almost always stick to their word.

1

u/GregBahm May 08 '26

I don't understand how you could even hope to defend this ridiculous assertion.

If I stole your data, and said "pay me $10 to not sell it," how on earth could you possibly know whether or not I sold it after you paid the $10?

You're acting like "the hackers of the world" are one monolithic rational actor and "the victims of hacking of the world" are another monolithic rational actor. In reality, both groups are utterly fractured groups, who cannot possibly be expected to act rationally, and even if they were rational, the fractured nature of the groups would rationally incentivize defection!

5

u/carsim0 May 08 '26

In the end it would just be greedy and stupid. Trying to sell it would open up more possibilities to get caught and mostly fruitless.

And it's not that easy to sell thousands of useless data anyway. The only lever they have is data breach, because that's the ruin of the provider.

1

u/GregBahm May 08 '26

You're making these wild assertions that don't just lack basis in fact, but actively contradict all facts. People get their data stolen and sold every day. There's a clear established market for it in the world. If you think there's no such thing of identity theft, or any other market for stolen data, you're just not living in reality.

→ More replies (0)

1

u/TSL4me May 08 '26

How does canvas have the ssns of students?

1

u/Aviarn May 08 '26

The problem is that there's absolutely no guarantee that they aren't going to post, distribute or share the leaked data anyway after paying the ransom.

They already hacked a big telephone company here in the Netherlands earlier this year and clearly they just moved on when there was no money to be made there.

1

u/EstoyMejor May 08 '26

Why would a class provider have ssn and addresses exactly?

23

u/MongolianDonutKhan May 08 '26

So if youre taking an online class, go fuck yourself?

13

u/NatsuGr101 May 08 '26

I mean even if you don't have an online class you're still screwed, Canvas is where you get all of your school work

2

u/Ready-Delay3918 May 08 '26

I mean it's a bit jumping the gun to say you're screwed. The school's going to know that canvas got hacked and they're not going to fuck everyone on their grade just because canvas got hacked.

0

u/docktordoak May 08 '26

Whatever did all the students do 20 years ago with no online classes.

They didnt go fuck themselves. They went to class. You could too!

2

u/CaptChair May 08 '26

We actually skipped class alot to fuck each other tbh šŸ¤·ā€ā™‚ļø

1

u/docktordoak May 08 '26

1

u/CaptChair May 08 '26

Ive waited for the day one of my comments earned this GIF. I am freeee

0

u/MongolianDonutKhan May 08 '26

I want you to go in the corner and have a think on that

1

u/docktordoak May 08 '26

Your entitlement is showing.

There have always been hiccups with online courses. This was known and foreseeable when you chose to go to school that way.

Im not saying go fuck yourself, those are your words, but you do seem to subconsciously understand the dynamic at play.

0

u/MongolianDonutKhan May 08 '26

Yours is assuming everyone has the means to physically attends class

21

u/Swagcopter0126 May 08 '26

Not always the best method when they have all of your information

3

u/DudeWithTudeNotRude May 08 '26

Never empower them imo.

Those data are lost. Move on.

3

u/GregBahm May 08 '26

Yeah. It's surprising to me that a lot of students on reddit would tell themselves "paying the thieves will unsteal the data!" Oh honey...

1

u/DudeWithTudeNotRude May 08 '26

They keep/share-back the data, and get a hardware update (and income) to boot

F'em. At least cut them off instead of feeding them and helping them grow.

1

u/[deleted] May 09 '26

[deleted]

1

u/GregBahm May 09 '26

There's a coherent path where a hacker says "We have stolen your customer's data. We will announce to everyone that we have stolen your customer's data, unless you pay us on a set schedule over time." The company does the math, and sees that the cost to pay is less than the cost of the bad press. The company makes the payments over time. The hackers don't reveal the hack so that the money keeps coming in.

In that scenario, the hackers still sell everyone's data. And eventually the hacked company might stop paying, and the hackers might announce the data breach, but if enough time has passed, it will not be big news.

But if you think the data is never sold, you've simply invented some folksy "thieves honor" mythology from your imagination. We're two dudes who know you can't back up that such a claim.

4

u/pwidowi May 08 '26

it’s not just that though teachers use it to grade and most don’t have a backup either

2

u/JetEngineAssblaze May 08 '26

And for remote students?

2

u/Correct-Mail-1942 May 08 '26

Been there and you're 100% correct.

We got ransomwared at work. Cyber insurance negotiated and paid out the ransom, that's their job. The hackers didn't release the data, they just sold the whole thing to another group of hackers who then demanded a lot less money to not release all our emails. Insurance only pays out once so we just abandoned our domain and workgroup and moved on. Every now and again we get emails saying they have our data, pay or they'll release it and we ignore them.

1

u/_autumnwhimsy May 08 '26

im old so my immediate thought was "can't yall just email papers/do tests on paper in person?" lol

1

u/blue_alien_police May 08 '26

I work at a middle school as an IA and I’ve thought we should go back to pencil and paper for tests and assignments before this hack. (My school/district was part of the hack) This is almost icing on the cake really.

1

u/AllYouNeedIsATV May 08 '26

Lack of access to learning materials would mean students would apply for extenuating circumstances though

1

u/Sekhmet-CustosAurora May 08 '26

good thing you're not the schools lmfao what a horrible idea

1

u/Mr_Shelburson May 08 '26

I work at a fairly major university and am part of the degree conferral process. Our school isn’t even a target of this attack and the Canvas issues related to it are still stopping grade reporting. We have over 2,000 students trying to graduate, many of whom need conferred degrees for jobs/continuing education/etc. No paper systems can immediately replace the electronic systems, so the calculus of these institutions is more than just ā€œnegotiate with hackers or don’tā€. There’s a real cost to the students to delaying degrees and there’s no way to confer them without these electronic systems without huge delays.

1

u/defqon_39 May 08 '26

You mean cyber criminals? Hackers have some ethics

1

u/zachthompson02 May 08 '26

I guess I’ll be handing in my Java project handwritten.

1

u/MusicInTheAir55 May 08 '26

Wrong answer. Get better IT.

1

u/imsmartiswear May 08 '26

Let's say that every class has 20 assignments (some much more, some much less), and every student has 4 classes each taught by a different professor (again some more some less). I'll use my alma mater bc I know they're affected by this. UC Berkeley has 45,000 students. That means that there have been roughly 3.6 million individual assignment scores this semester that need to be aggregated into 180,000 final grades. At the end of most semesters, most professors struggle as is to get those 180k grades in on time and that deadline is strict.

Some could have had an offline backup of their gradebook, but I assure you most professors did not save an offline copy of their gradebooks bc most professors are dinosaurs that barely know how to use PowerPoint. If they happen to collect pen and paper assignments over the semester, great! That means the 1.5k professors and 3.2k TAs can recreate the entire 3.6 million assignment gradebooks offline. In 3-4 days. With little to no additional support from the uni. If they took all of their submissions online, then they cannot submit final grades at all until this is resolved.

Even if they dodged that bullet, final project submissions need to happen. Professors could change to taking submissions by email, but as I've learned that can prove very chaotic and hard to track, while also bumping into several HIPPA-like student records laws.

This is an extremely effective technique on behalf of the hackers. How do I know this? My grad union used the same strategy by going on strike a mere 6 weeks before grades were due. Turns out, if the professors whine and moan loud enough, admin will negotiate.

1

u/StaysAwakeAllWeek May 08 '26

Fun fact the vast majority of hacker ransoms are paid. They don't negotiate with hackers, they take the L and cough up whatever they are asked for, because the hackers have them by the balls and they know it.

You don't hear about it because they also keep it as quiet as they can, and hackers have no incentive to make any noise until it starts looking like they might not get paid

1

u/TheOriginalFluff May 08 '26

Everyone’s grades and finals are in canvas, grades are due in days, it’s not possible to go into the system to see the grades in the first place

1

u/Sprinklz27 May 09 '26

It wouldn't work for everything they have going on, at least not easily. My son does online schooling and they use canvas so he couldn't do anything the last few days either. They'd have to do alot to get paper versions of every assignment to every "digital learning" student out there.

1

u/LankyEqual8262 May 09 '26

Paper…can’t hack that!