Northwestern University

Profile narrative

Northwestern University is a higher education institution located in the United States that offers undergraduate and graduate academic programs across a range of disciplines and engages in research activities. Its core mission involves teaching students, facilitating scholarly inquiry, and awarding credentials through degree programs. The university supports its educational functions with a variety of digital services that enable course delivery, collaboration, and administrative operations.

Among the digital tools employed by the institution are the Canvas learning management system, which hosts course materials, assignments, and grades, and wiki platforms such as MediaWiki and TWiki that are used for collaborative knowledge sharing and documentation. These systems are integral to the day‑to‑day academic workflow, allowing faculty to distribute content, students to submit work, and groups to maintain shared knowledge bases. The reliance on these platforms means that any disruption or compromise directly affects teaching, learning, and administrative continuity.

In May 2026 a global cyberattack attributed to the ShinyHunters group targeted Canvas, compromising data for approximately 275 million users across thousands of institutions and exposing usernames, email addresses, and enrollment information; Instructure worked with forensic experts, paid the attackers to restore the data, and pledged no further extortion of its customers, while Northwestern postponed exams and assignments, staff sought alternative teaching methods, and efforts were made to restore access by the weekend. In April 2023 attackers exploited vulnerabilities in MediaWiki and TWiki to upload spam pages promoting fake Fortnite gift cards and cheats, redirecting users to phishing forms designed to steal credentials, and the campaign also affected government websites including a European Union portal. In May 2018 unauthorized actors compromised the chief financial officer’s email account, monitored communications, intercepted a legitimate vendor payment, and redirected funds, resulting in a financial loss of nearly $60,000 for the institution. In April 2015 a server breach occurred through an XSS vulnerability followed by SQL injection, disclosed by an attacker known as 'MLT', which exposed administrator credentials but did not involve personal data according to the university, prompting the affected network segments to be taken offline for over a week during remediation.

The university’s response to these incidents included working with forensic experts, paying attackers to restore data, taking network segments offline, implementing alternative teaching methods, and undertaking remediation efforts to secure credentials and harden web applications. These actions reflect the ongoing need to protect the digital infrastructure that underpins its educational and research missions. Northwestern continues to rely on platforms such as Canvas, MediaWiki/TWiki, and internal servers to fulfill its core functions while addressing the security challenges highlighted by these events.

Incidents

4 incidents linked to this organisation.