Canvas Hacked: My Data Got Stolen and Yours Probably Did Too.

‎Canvas Hacked: My Data Got Stolen and Yours Probably Did Too. ‎ ‎My name is not important. But what happened to me last week could happen to any student in America. Or Hong Kong. Or Australia. Or anywhere really. ‎ ‎I am a college student. Junior year. Studying computer science actually. The irony is not lost on me. ‎ ‎I woke up on May 7 like any other Thursday. Rolled out of bed. Made some instant coffee because I am too broke for real coffee. Opened my laptop to check if my professor had posted the study guide for my final exam. ‎ ‎The Canvas login page looked weird. ‎ ‎Something was off about it. The colors were wrong. The logo was in the wrong place. And there was a message on the screen that I had never seen before. ‎ ‎I read the message. Then I read it again. ‎ ‎It said something about hackers. About data being stolen. About billions of private messages. About a group called ShinyHunters. ‎ ‎I thought it was a joke at first. Maybe someone had figured out how to change the login page as a prank. College students do stupid things sometimes. ‎ ‎But then I tried to log in. Nothing happened. I tried again. Still nothing. ‎ ‎I texted my friend in the same class. She could not log in either. I texted another friend. Same problem. ‎ ‎That is when I knew it was real. ‎ ‎The Panic That Followed ‎ ‎Within an hour, my phone would not stop buzzing. Group chats were exploding. People were posting screenshots on Instagram and Twitter and Reddit. Everyone was asking the same questions. ‎ ‎What happened to my data? ‎Did the hackers get my messages? ‎Should I change my password? ‎Can I still submit my paper? ‎ ‎Nobody had answers. Not the professors. Not the IT department. Not even the company that makes Canvas. ‎ ‎The university sent out an email around noon. It said they were aware of the issue and working on it. That was it. No details. No timeline. No apology. ‎ ‎I spent the rest of the day refreshing the Canvas page every hour like a crazy person. Nothing changed. ‎ ‎The Messages I Wish I Had Not Sent ‎ ‎Here is the thing that keeps me up at night. I have sent some private messages through Canvas. ‎ ‎Nothing bad. Nothing illegal. But personal stuff. ‎ ‎Last semester I was struggling with my grades. My GPA dropped. I was scared I would lose my scholarship. I messaged my professor through Canvas. I told him about my anxiety. About the pressure I was feeling. About how I was not sleeping. ‎ ‎He was kind. He gave me advice. He told me to take care of myself. ‎ ‎Those messages are probably in the hands of hackers right now. ‎ ‎My friend Sarah messaged her advisor about changing her major. She was embarrassed about it because her parents did not know yet. Those messages are probably stolen too. ‎ ‎My roommate messaged his professor asking for an extension because his grandfather died. That was personal. That was painful. And now strangers might read it. ‎ ‎The hackers said they have billions of messages. Billions. That means not just my messages. Not just my friends' messages. Everyone's messages. ‎ ‎Every late night cry for help. Every confession of failure. Every request for mercy. ‎ ‎All of it. In the hands of people who want to hurt us. ‎ ‎The Group That Did This ‎ ‎I did some research on Shiny hunters. The hackers who claimed responsibility. ‎ ‎They are not some mysterious organization from a foreign country with supercomputers and secret agents. They are kids. Teenagers. Young adults from America and England. ‎ ‎They have done this before. They hacked Ticketmaster. They stole data from Live Nation. They have a whole history of breaking into companies and demanding money. ‎ ‎A group of kids shut down education for millions of people. ‎ ‎Think about that. Kids. With computers. Probably sitting in their bedrooms. Eating pizza and drinking soda while we all panic. ‎ ‎It makes me angry. Not scared. Angry. ‎ ‎What I Learned About My Own Data ‎ ‎The company that owns Canvas is called Instructure. They finally released a statement on May 8. A whole day after the attack. ‎ ‎They said only names, email addresses, student ID numbers, and messages were stolen. They said no passwords. No birth dates. No financial information. ‎ ‎I do not believe them. ‎ ‎Not because I have proof they are lying. But because every company says that after a data breach. And then months later they admit it was worse. ‎ ‎Remember the big credit bureau hack a few years ago? They said only a few million people were affected. Then it turned out to be over a hundred million. ‎ ‎Remember the hotel chain hack? They said no payment data was stolen. Then they found malware on their payment systems. ‎ ‎Companies always downplay the damage. Always. It is not because they are evil. It is because they are scared. Scared of lawsuits. Scared of customers leaving. Scared of the government fining them. ‎ ‎But that fear does not help us. The students. The ones whose data is out there. ‎ ‎The Deadline That Scares Me ‎ ‎The hackers gave schools until May 12 to pay them. That is just a few days from when I am writing this. ‎ ‎If no one pays, they say they will release everything publicly. ‎ ‎I do not know if my school will pay. I do not know if any school will pay. I do not know if Instructure will pay. ‎ ‎What I do know is that I cannot do anything about it. I am just a student. I do not have millions of dollars to give to hackers. I cannot negotiate with criminals. I cannot force the company to fix their security. ‎ ‎All I can do is wait. And hope. And maybe change my passwords. ‎ ‎How I Am Protecting Myself ‎ ‎Here is what I have done since the attack. Maybe it will help you too. ‎ ‎First, I changed my Canvas password. I know Instructure said passwords were not stolen. I changed it anyway. It took two minutes. Now I feel a little better. ‎ ‎Second, I changed every other password that was the same as my Canvas password. I used to reuse passwords because it was easier to remember. Not anymore. Now I have different passwords for everything. I wrote them down in a notebook. Not the most high tech solution but it works. ‎ ‎Third, I am watching my email like a hawk. The hackers have my email address and my name. They could send me fake messages pretending to be from my university. I am not clicking any links until I know for sure they are safe. ‎ ‎Fourth, I emailed my professor. I told him I cannot access Canvas. He said not to worry. He extended the deadline for everyone in the class. I wish every professor was like that. ‎ ‎Fifth, I told my parents what happened. They do not really understand computers. But they needed to know. Just in case something weird happens with their bank accounts or their email. ‎ What My University Is Doing ‎ ‎My university has been okay about this. Not great. But okay. ‎ ‎They sent out a few emails. They set up a hotline for students with questions. They extended deadlines for most assignments. ‎ ‎But they have not told us much about what data was stolen. They have not told us if they are going to pay the ransom. They have not told us what they are doing to make sure this never happens again. ‎ ‎I get it. They are figuring things out. But I wish they would be more transparent. We are adults. We can handle bad news. Just tell us the truth. ‎ ‎What I Think Will Happen ‎ ‎I am not a psychic. But I have been studying computer science for three years. I know a little about how these things work. ‎ ‎Here is my prediction. ‎ ‎Some schools will pay the ransom. Probably the rich ones. The ones with money to throw at problems. ‎ ‎Other schools will not pay. They will hope the hackers do not release their data. ‎ ‎The hackers will release some data anyway. Maybe not all of it. But some. Enough to prove they are serious. Enough to scare the schools that did not pay. ‎ ‎Then things will get quiet for a while. The news will move on to something else. The hackers will target a different company. ‎ ‎And we will be left to deal with the consequences. Phishing emails. Identity theft. Embarrassment. Fear. ‎ ‎That is how these things always go. ‎ ‎What Should Change ‎ ‎This attack should never have happened. Not because hackers are evil. Hackers will always exist. That is just reality. ‎ ‎But because Canvas should have been more secure. ‎ ‎They knew about the first breach on April 29. They had over a week to lock things down. Over a week to kick the hackers out for good. Over a week to tell us what was happening. ‎ ‎They did none of that. Or if they did, it did not work. ‎ ‎Companies that store our data need to be held accountable. There need to be consequences. Fines. Lawsuits. Something. ‎ ‎Because right now, there is no incentive for companies to spend money on security. It is cheaper to get hacked and apologize than to prevent the hack in the first place. ‎ ‎That is backwards. And it needs to change. ‎ ‎My Final Words ‎ ‎If you are reading this and you use Canvas, please be careful. Change your password. Watch your email. Do not click on suspicious links. ‎ ‎If you are a professor reading this, please be patient with your students. We are scared. We are confused. We are trying our best. ‎ ‎If you are a parent reading this, please talk to your kids about online safety. Help them set up strong passwords. Teach them not to share personal information online. ‎ ‎And if you are one of the hackers reading this? I do not know what to say to you. You have caused a lot of pain. You have scared a lot of people. I hope it was worth it. ‎ ‎I am going back to studying for my finals. Assuming I can access my study guide. ‎ ‎Wish me luck. ‎ ‎--- ‎ ‎Share this with your classmates. We are all in this together. ‎ ‎written by DDM ATIQ