Pittsfield Public Schools says secondary progress reports impacted by Canvas data breach

PITTSFIELD — Secondary school progress reports, which were set to go out Friday for Pittsfield students, were impacted by a recent data breach.
Canvas, a platform the schools use to publish course information and assignments and facilitate messages between students and teachers, was compromised on April 29 and May 7.
"Typically, Canvas speaks to our PowerSchool system, and that's where parents get the grades," Interim Superintendent Latifiah Phillips said during Wednesday's School Committee meeting. Because of the incident, "the API integration that allows information to sync between Canvas and PowerSchool has been temporarily disabled," the district said in a statement.
Because of that, "the district may be unable to print fully accurate progress reports for secondary students until the issue has been resolved," it said. Elementary school grades were not affected because they are directly input into PowerSchool. Secondary school grades are still being input into Canvas and the district advised parents to check it directly for the most up-to-date grade information.
District officials said the disruption stems from a broader cybersecurity incident affecting schools and colleges worldwide; the hacking group ShinyHunters took responsibility for both breaches and claimed it had accessed the data of more than 275 million users at nearly 9,000 schools worldwide during the April 29 hack.
After the first hacking incident, Canvas said that "usernames, email addresses, student ID numbers and communications" had been exposed. On Monday, Instructure, the company that owns Canvas, said that it reached an agreement with the "unauthorized actor" involved in that incident but did not explicitly name who was resposible. The company said it has not found any evidence that data was taken during the May 7 breach.
“While there is never complete certainty when dealing with cybercriminals, we believe it was important to take every step within our control to give customers additional peace of mind, to the extent possible,” Instricture said. The agreement resulted in the return and destruction of the stolen data and assurances that affected customers would not be extorted.
"This agreement covers all impacted Instructure customers, and there is no need for individual customers to attempt to engage with the unauthorized actor," Instructure said.
Pittsfield Public Schools and Massachusetts College of Liberal Arts said that usernames, email addresses, student ID numbers and messages exchanged within Canvas may have been accessed. Phillips confirmed at Wednesday's meeting that course submissions, grades, dates of birth, health care information, Social Security numbers and disciplinary records were not breached. An MCLA spokesperson said on Monday that "no financial information or passwords were compromised."
Instructure said it is actively investigating the breaches and began contacting impacted organizations on May 5.
"We continue to work with expert vendors to support our forensic analysis, further harden our environment, and conduct a comprehensive review of the data involved," the company said.
Spokespeople for Pittsfield Public Schools and MCLA did not immediately respond to questions from The Eagle about whether the schools have taken additional steps to secure student data.
Both schools previously said that they will continue to monitor the situation and provide updates as they become available.
"We understand that this situation may cause frustration and inconvenience, and we appreciate your patience and understanding as Canvas works to restore full functionality," Pittsfield Public Schools said.
Read the Original Article
This article was originally published by Berkshire Eagle. Click below to read the full article on their website.
Visit Berkshire Eagle
