Penn State is one of many schools being affected by a cyberattack on web-based software just as the semester ends and faculty are trying to get their grades in for seniors before this weekend’s graduation ceremonies.
Some Penn State faculty logging in to manage their classes and enter their grades Thursday were instead met with an ominous message: “ShinyHunters has breached Instructure (again).” ShinyHunters is a cybercrime group, and Instructure is the parent company of the software Canvas, which is used for grading, along with lessons and assignments.
The ShinyHunters message goes on to say that schools on the affected list that want to prevent the release of data have to contact ShinyHunters privately by the end of the day May 12 to negotiate a settlement.
In a message to the university community, Penn State said it "is currently experiencing an outage to Canvas related to an ongoing security incident affecting Instructure, the vendor that provides the Canvas platform." The university says that “users should avoid interacting with or clicking on any links, messages, or content that may be posted by threat actors or appear suspicious during this event.”
Matt Jordan, a professor of media studies and head of the department of film production and media studies at Penn State, was one of many faculty unable to finish getting their grades in. Jordan teaches large classes that are dependent on Canvas.
“I'm midway through grading right now, so I'm not exactly sure what I'm going to do," Jordan said. "And the timing is not ideal, given that grades are due soon and people need to graduate this weekend.”
Jordan says he thinks there is a lot to be concerned about with universities’ push toward increasing use of AI and digital.
“I think universities do a great job of doing the analog version of education very well," he said. "So I think the more we make ourselves dependent on these things for ease and convenience, the more we open ourselves up to this type of risk."
In a message posted on the site Ransomware.live, which tracks ransomware groups, ShinyHunters claims to be affecting nearly 9,000 schools worldwide.
