Needham Public Schools

Summary

Needham Public Schools officials said they are operating under the assumption that all students and staff were affected by a cybersecurity incident involving the Canvas learning platform. They reported that unauthorized access led to the download of first names, last names and email addresses for everyone in the district and that teacher gradebook data linked to the PowerSchool system might have been altered. The district disconnected Canvas from PowerSchool to stop any further compromise and asked Instructure for a full report detailing what information was accessed or changed. Instructure said it detected unauthorized activity, revoked the intruder’s access and began an investigation, later identifying additional unauthorized activity tied to the same event. Wellesley High School, also a Canvas user, was noted as one of approximately nine thousand institutions impacted by the breach.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

Instructure detected unauthorized activity April 26, revoked access, and started an investigation. Needham Public Schools learned of the breach May 1 and learned May 7 that data from the district had been downloaded. The district was also notified of a second breach May 7. Superintendent Dan Gutekanst said the district was operating under the assumption that all students and staff were affected. According to Gutekanst, the information accessed included first names, last names, and email addresses for all Needham Public Schools students and staff. Wellesley High School is also a Canvas client, and district officials said the campus is among approximately 9,000 affected institutions.

Gutekanst said the unauthorized actor made changes to the pages that appeared when some students and teachers were logged in through Canvas. Out of caution, the district temporarily took Canvas offline into maintenance mode to contain the activity, investigate, and apply additional safeguards. The district was informed that teacher gradebook data connected to the PowerSchool student information system could have been modified. Gutekanst said NPS disconnected Canvas from PowerSchool to prevent any further potential compromise of data or systems. According to the superintendent, the district requested a complete report on the incident from Instructure, asking that the report include information about what data was breached or modified. The district is also continuing to closely monitor the situation and review any additional systems that could potentially have been affected downstream.

Sources

Sources available to members: 1 source.