Your kid's school data may have been hacked — here's how to protect your family

In an era where every little detail about your personal life is shared and transmitted digitally, the fear of your information being compromised is very real. But when it comes to the personal information of your children, that fear becomes amplified by a significant magnitude.

That's where Cary, North Carolina native Lisa Baildon found herself after her daughter's school, Millbrook High, was the victim of a cybersecurity breach in early May. The program they use for remote learning, Canvas, was compromised. The data breach affected an estimated 9,000 institutions across Australia, Canada and the United States, including universities, whose students were in the midst of finals.

"Who did it and what are they going to do with the data?" she said, during an interview with ABC 11 (1).

Must Read

The Canvas breach is part of a bigger problem

Canvas, for those unfamiliar, is an online platform that allows students to access schoolwork, submit assignments and store grades. For university students, financial details factor in far greater than with high schools. To be clear, though, there is no evidence suggesting passwords, dates of birth or financial information were shared.

At Mississippi State University, Aubrey Palmer, a meteorology student, told the BBC (2) they had just finished a 2,900-word essay exam when they received an alert on their screens.

"ShinyHunters has breached Instructure (again)," it read.

ShinyHunters (3) is a hacker and extortion group that has been active since 2020. It has been responsible for several massive data breaches, data theft and extortion efforts targeting global corporations and organizations like AT&T (4), Google (5) and Ticketmaster (6).

ShinyHunters typically does its work by making English-language phone calls and impersonating employees to trick company staff into granting access. In this instance, they exploited flaws in the Free-For-Teacher accounts on April 29. Canvas owner and developer Instructure said hackers were able to obtain names, email addresses, student ID numbers and user messages.

The threat was thought to have receded, but ShinyHunters regained access the very next day, on April 30.