Canvas hack: Houston-area schools, universities release statements regarding outage

HOUSTON - Canvas, a widely used school learning platform, has reportedly been hacked and is experiencing outages, which are causing problems for thousands of universities, schools and students nationwide. 

Canvas hack: Schools across the U.S. affected by outage affecting education for students

What we know:

Numerous campuses across the state and nation are affected by the outage. 

The hacker group, by the name of ShinyHunters, stated they confirmed the breach of the system and are threatening potential data leaks. 

Locally, several Houston-area school districts and universities have confirmed the outages. 

Local perspective:

Some of the schools listed by the hacker include major universities such as Baylor, Texas Tech, University of Texas San Antonio, University of Texas at Arlington, University of Texas at Dallas, and many others. 

Several local school districts and universities are also on the list including: 

• Alvin Community College
• College of the Mainland
• Galveston College
• Houston City College
• Rice University
• St. Thomas University
• Texas Woman's University
• University of Houston
• University of Houston-Downtown
• Aldine ISD
• Alief ISD
• Conroe ISD
• Crosby ISD
• Harmony Public Schools
• Houston ISD
• IDEA Public Schools
• Katy ISD
• Klein ISD
• Pasadena ISD
• Pearland ISD
• Texas City ISD
• Waller ISD

This list is only a fraction of the overall campuses across the United States that have been affected. There may be other districts not listed that have been affected as well. 

What is Canvas?

Canvas, which is a learning management system (LMS), supports online course organization, assignments, grading, video conferencing, and a range of educational tools for schools and universities.

What they're saying:

The company that runs Canvas, called Instructure, posted a note on their website saying, "Canvas, Canvas Beta and Canvas Test are currently in maintenance mode. We anticipate being back up soon."

Universities and school districts in the Houston area have released statements regarding the outage.

Rice University

"Rice has been impacted and we are working to mitigate the situation."

Texas Woman's University

"The Canvas platform is out of service because of a nationwide cybersecurity incident, which is affecting all three of TWU’s campuses. The university is aware this will impact submissions such as assignments and grades to the Canvas platform. The university is extending leniency to Canvas platform users because of these circumstances and will provide guidance as soon as additional details become available."

University of Houston

"The University of Houston is aware of a global service disruption affecting the Canvas LMS platform, which is currently unavailable due to a cybersecurity incident involving its parent company, Instructure. The UH UIT team is actively investigating and monitoring this situation. This incident was not specifically directed at the University of Houston or any of its system universities. We will provide more information to our community as it becomes available."

Conroe ISD

"Conroe ISD, along with universities and school districts globally, has been impacted by the ongoing Canvas by Instructure security incident. Conroe ISD has communicated with families and staff on the situation.

We are actively monitoring updates from Instructure and will continue updating families and staff as additional information becomes available. While the issue originates with the third-party Canvas platform and is not related to Conroe ISD systems, the district is working to minimize disruptions to teaching and learning during the outage."

Houston ISD

In an updated statement on Thursday evening, Houston ISD said, "Instructure, which manages the Canvas platform, has indicated there is no evidence of passwords, DOBs, government identifiers, or financial information being involved in the incident."

First statement: "This afternoon, a cybersecurity incident involving Canvas impacted school districts and other institutions nationwide. The issue is related to the Canvas platform and is outside of HISD’s control. Canvas is actively working to secure its systems and restore access as quickly as possible, and HISD teams remain in communication with the provider regarding updates and restoration efforts.

While Canvas works to resolve the issue, HISD is standing up a temporary Google site to provide access to curriculum materials. The site is expected to be available within the next few hours, and we will send an additional update once it is live.

We recognize the disruption this may cause and appreciate your patience and cooperation as Canvas works to resolve the issue and HISD implements a solution to ensure teachers have the resources they need for instruction. Our priority is to minimize disruption and continue supporting teaching and learning during this outage."

Katy ISD

"Dear Katy ISD Parents/Guardians and Staff,

This message is to inform our families, students, and staff that Canvas, the district’s learning management system, is currently unavailable. Katy ISD has been notified by Canvas, the vendor that provides our learning management platform, of a cybersecurity incident that is actively under investigation. While the incident was not directed at Katy ISD, it has affected thousands of organizations that use Canvas services.

Canvas has indicated that certain user information may have been exposed, including names, email addresses, student ID numbers, and messages exchanged within the platform. Please note that more sensitive personal information, such as Social Security numbers, home addresses, and passwords, is not stored within Katy ISD’s Canvas environment and was not impacted.

To help protect student and staff information, the Katy ISD Technology Department is actively monitoring the situation and working closely with Canvas to assess any potential effects on our systems.

Updated information, including a timeline for when Canvas will be operational again, will be shared as soon as it becomes available from the vendor.

We appreciate your continued support and understanding."

Pearland ISD

"Dear Pearland ISD Parents and Guardians,

At Pearland ISD, we believe in maintaining full transparency with our families regarding the digital tools we use in the classroom. We are writing to share that Instructure, the company that hosts our learning platform Canvas, recently notified us of a cybersecurity incident on their end. This incident was not directed at Pearland ISD but is part of a nationwide breach affecting nearly 9,000 school districts and universities across the country.

We want to be clear, this incident did not affect Pearland ISD’s internal network or our secure databases. However, because we value your trust, we want to provide you with the facts regarding the limited information stored within the Canvas cloud:
 

• Pearland ISD does not share passwords, dates of birth, government identifiers, or financial information with Instructure.
• The only data Pearland ISD shares with this platform consists of student names and email addresses.
• Our district already has safety measures in place that further mitigate any risk; we keep Canvas messaging disabled and restrict student email accounts to only receive messages from .edu or military domains.

Instructure is currently finalizing a full forensic investigation and are staying in close contact with their team. Should you have any immediate questions, you may reach out directly at info@instructure.com.

In the meantime, we ask that you remain alert to the following:
 

• Watch for phishing messages.
• Do not click links in unsolicited emails referencing Canvas, Instructure, or Pearland ISD. If you receive a suspicious message, do not interact with it and delete it.

Thank you for your continued support in keeping our school community safe and informed.

Sincerely,
Pearland ISD Technology"