Pittsfield Public Schools says student info on Canvas was potentially compromised

PITTSFIELD — On Sunday, Pittsfield Public Schools said student information on Canvas may have been "potentially accessed" during a recent cybersecurity incident involving the platform.
Canvas is a platform used by schools to publish course information and assignments, and it also facilitates messaging between students and teachers. The platform has more than 30 million users.
According to CNN, Instructure, the company that owns Canvas, posted on May 1 that it “experienced a cybersecurity incident perpetrated by a criminal threat actor.” The company said it had contained the incident but "usernames, email addresses, student ID numbers and communications" had been exposed.
"This incident involved unauthorized access to part of our environment," a statement from Instructure CEO Steve Daly reads. "The data fields involved include information like usernames, email addresses, course names, enrollment information and messages. Core learning data (course content, submissions, credentials) was not compromised."
Pittsfield Public Schools said that "names, email addresses, student ID numbers and messages exchanged within Canvas" may have been accessed, but that "passwords, dates of birth, Social Security numbers, financial information, or other government identifiers" were not breached.
The hacking group ShinyHunters claimed responsibility in a ransom note posted online on May 3, saying it had breached the data of 275 million users.
On Thursday, reports emerged that the group had breached Canvas again and posted a ransom message warning schools they had until Tuesday to reach a settlement or risk having their data leaked. Instructure subsequently took Canvas offline through Friday while it investigated the incident.
MassLive reported that several state colleges were affected by Thursday and Friday's Canvas outages, including Harvard University, the University of Massachusetts Amherst and the Massachusetts College of Liberal Arts. Instructure said that it has not found any evidence that data was taken during Thursday's breach.
Instructure said it is actively investigating the breaches and began contacting impacted organizations on May 5.
"If your organization has not heard from us directly, we have not found evidence that your data was involved," a statement from Instructure reads. "Our investigation is ongoing and if we learn more, we will communicate with your organization directly.
Pittsfield Public Schools said that Instructure will give clear guidance if any further actions are required by the district and the company will give another update to the district by Monday evening.
Pittsfield Public Schools said Instructure's investigation remains ongoing and that, as of Sunday, Canvas was up and operational for the district.
The district instructed anyone with questions of concerns about the data breach to contact its technology department at 413-499-9568.
Read the Original Article
This article was originally published by Berkshire Eagle. Click below to read the full article on their website.
Visit Berkshire Eagle
