Instructure, Stanford, Auckland University of Technology and Harvard: Auckland students' details caught up in massive global university hack

Global Cyberattack Disrupts Learning Platforms at New Zealand and U.S. Universities

A widespread cyberattack has compromised Canvas, a widely used online learning platform, affecting universities in New Zealand and the U.S., including the University of Auckland, Auckland University of Technology (AUT), Harvard, and Stanford. The breach, attributed to a hacking group targeting Instructure, Canvas’s parent company, exposed names, email addresses, student ID numbers, and private messages between users.

The attack forced Canvas offline, prompting universities to implement urgent workarounds to mitigate disruptions to teaching and assessments. While no passwords, sign-on credentials, or student assessment data were reportedly compromised, the hackers left a message in the system, demanding schools contact them by May 12 to negotiate a settlement or risk public data leaks. The group claimed Instructure had previously ignored their warnings and applied only superficial security fixes.

At AUT, staff were instructed to log out of Canvas, and students were granted assessment extensions while the platform remained inaccessible. The University of Auckland confirmed its internal systems were unaffected but acknowledged potential adjustments to academic deadlines. Canvas is used by over 9,000 education systems worldwide, underscoring the scale of the incident.

The breach highlights vulnerabilities in third-party education platforms and the growing threat of ransom-driven cyberattacks targeting academic institutions.

Source: https://www.rnz.co.nz/news/education/594635/university-of-auckland-s-online-learning-system-hit-by-hackers

Instructure TPRM report: https://www.rankiteo.com/company/instructure-inc-

Stanford TPRM report: https://www.rankiteo.com/company/stanford-university

Auckland University of Technology TPRM report: https://www.rankiteo.com/company/university-of-auckland

Harvard TPRM report: https://www.rankiteo.com/company/harvard-university

"id": "unistainshar1778200829",
"linkid": "university-of-auckland, stanford-university, instructure-inc-, harvard-university",
"type": "Ransomware",
"date": "5/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"

{'affected_entities': [{'industry': 'Education',
                        'location': 'New Zealand',
                        'name': 'University of Auckland',
                        'type': 'University'},
                       {'industry': 'Education',
                        'location': 'New Zealand',
                        'name': 'Auckland University of Technology (AUT)',
                        'type': 'University'},
                       {'industry': 'Education',
                        'location': 'U.S.',
                        'name': 'Harvard',
                        'type': 'University'},
                       {'industry': 'Education',
                        'location': 'U.S.',
                        'name': 'Stanford',
                        'type': 'University'},
                       {'customers_affected': 'Over 9,000 education systems '
                                              'worldwide',
                        'industry': 'Education Technology',
                        'location': 'U.S.',
                        'name': 'Instructure',
                        'type': 'Company'}],
 'data_breach': {'personally_identifiable_information': 'Names, email '
                                                        'addresses, student ID '
                                                        'numbers',
                 'sensitivity_of_data': 'High',
                 'type_of_data_compromised': 'Personally Identifiable '
                                             'Information, Private Messages'},
 'description': 'A widespread cyberattack has compromised Canvas, a widely '
                'used online learning platform, affecting universities in New '
                'Zealand and the U.S., including the University of Auckland, '
                'Auckland University of Technology (AUT), Harvard, and '
                'Stanford. The breach exposed names, email addresses, student '
                'ID numbers, and private messages between users. The attack '
                'forced Canvas offline, prompting universities to implement '
                'urgent workarounds to mitigate disruptions to teaching and '
                'assessments.',
 'impact': {'data_compromised': 'Names, email addresses, student ID numbers, '
                                'private messages',
            'downtime': 'Platform offline',
            'identity_theft_risk': 'Potential',
            'operational_impact': 'Disruptions to teaching and assessments, '
                                  'assessment extensions granted',
            'systems_affected': 'Canvas online learning platform'},
 'lessons_learned': 'Highlights vulnerabilities in third-party education '
                    'platforms and the growing threat of ransom-driven '
                    'cyberattacks targeting academic institutions.',
 'motivation': 'Ransom',
 'post_incident_analysis': {'root_causes': 'Instructure allegedly ignored '
                                           'warnings and applied superficial '
                                           'security fixes'},
 'ransomware': {'data_exfiltration': 'Threatened public data leaks',
                'ransom_demanded': True},
 'response': {'containment_measures': 'Universities instructed staff to log '
                                      'out of Canvas, workarounds implemented'},
 'threat_actor': 'Hacking group',
 'title': 'Global Cyberattack Disrupts Learning Platforms at New Zealand and '
          'U.S. Universities',
 'type': 'Data Breach, Ransomware'}