Cybercrime group claims 600K records stolen from UC Berkeley Canvas amid nationwide blackout

[usonian]

https://www.dailycal.org/news/campus/cybercrime-group-seizes-uc-berkeley-canvas-600k-student-staff-records-at-risk/article_5b3b01de-bcad-45a1-994b-e0d19aa88591.html

Aarya Mukherjee | Senior Staff May 7, 2026

UC Berkeley’s learning management platform bCourses, the software that all 43,000 students use to access their class materials, has been seized by hackers. When some students attempted to log in Thursday afternoon, they were met with a red warning label, informing users that Instructure — the company that operates Canvas — has refused to pay a ransom.

In a statement to The Daily Californian, the black-hat cybercrime group ShinyHunters claims to have stolen “more than 600,000” UC Berkeley student and staff records and says it will leak them unless the campus pays a ransom.

Students’ access to Canvas was restored Friday afternoon, with campus officials advising that some may experience “intermittent performance as the bCourses platform stabilizes.”

The Canvas takedown affected hundreds of thousands of students nationwide as universities utilizing the Instructure service have seen their learning platforms pushed offline, with the same red warning message appearing on user screens

Lots more at the link.

Note:
According to 2024 data, Canvas is used by 41% of higher education institutions in North America.

[hunter]

1. I'm glad the records of my college years are sparse.

Storing paper and electronic records was expensive.

Paper records were stored in mobile shelving like this:



https://en.wikipedia.org/wiki/Mobile_shelving

Electronic records were ephemeral.

Term papers and tests were all on paper and returned to the student after they were graded. When you talked "off the record" to a college dean, department chair, or campus police " it was really off the record.

Throughout my college years I used only two addresses: my parents' and my university post office box. I had no phone. My university ID didn't have a magnetic stripe or RFID chip. A photograph of my face wasn't stored in any electronic databases.

It took me nine years to graduate from college, I was an affable lunatic who took a lot of time-outs, some of them less voluntary than others. In today's world how much of that would be documented in electronic records, possibly available to random hackers on the internet?

I graduated from college without any student loans. During the time-outs from college I worked. It was possible for an affable lunatic to find temporary work, and that explained the time-outs to potential employers -- obviously I was paying for college which wasn't quite true but nobody had to know.

This "everything on the internet" approach to education, or to society in general, is not a good thing. Our privacy shouldn't depend on the security of massive electronic databases that record our lives in ever-increasing detail. Such databases simply shouldn't exist. We've traded away our privacy and endangered our liberty for convenience and a false sense of security.

[usonian]

2. I remember when LMS software was written in-house as open source and KEPT in-house.

I was an early Moodle adopter and supporter.
SIMPLE IS BEAUTIFUL
Complex is expensive and impossible to harden.

One thing about "IT Managers" (except my stint as an IT Director)
CROWD-FOLLOWERS