Boise State University

Summary

Boise State University canceled its final exams after a cyberattack on the Canvas learning platform disrupted services for thousands of institutions. The attack began with unauthorized access detected earlier, followed by an actor altering Canvas pages and prompting the provider to take the site offline, exposing names, email addresses, student IDs and messages. The hacking group ShinyHunters claimed responsibility, noting prior intrusions at Ticketmaster, AT&T and other education‑related targets. Instructure later said the breach stemmed from a vulnerability in Free‑For‑Teacher accounts, which it has temporarily disabled, and confirmed that Canvas was restored after the incident.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

In late April, Instructure detected unauthorized activity on its Canvas learning platform and immediately revoked the offending party's access. Despite that early intervention, on Thursday an unauthorized actor gained the ability to modify Canvas pages, prompting Instructure to take the entire service offline. The disruption occurred while many colleges were in the midst of final exam preparations, and the shutdown exposed personal data such as names, email addresses, student IDs and private messages, which appeared to have been breached. Students who tried to access the Harvard Canvas site on Thursday were redirected to a message from the hacking group ShinyHunters, which claimed responsibility for breaching Instructure and published a list of affected institutions. Instructure later confirmed that the attackers had exploited a vulnerability associated with Free‑For‑Teacher accounts, a feature it subsequently disabled pending further investigation. By Friday, Instructure announced that Canvas had been restored to online operation after implementing containment measures.

The outage forced several universities to alter their examination schedules, with Penn State announcing the cancellation of Thursday night and Friday final exams and noting that students could still participate in graduation ceremonies without those grades. Boise State University followed suit by canceling its Friday final exams, while Mississippi State opted to reschedule those exams for Saturday. UT San Antonio chose to postpone both assignments and exams to a near‑future date that had not been specified at the time of reporting. James Madison University shifted its Friday morning exams to Wednesday, adjusting the timetable to accommodate the platform's unavailability. Across the affected campuses, students reported confusion and logistical challenges as they had already purchased caps and gowns for commencement ceremonies. The attack underscored education's growing reliance on singular technology platforms.

Sources

Sources available to members: 1 source.