Since 2019, the School has relied on the digital learning management system Canvas by Instructure for assignments, grading, and class resources. After criminal hacking group ShinyHunters compromised the platform’s data and put many institutions’ private info up for ransom, the school removed access for an extended period of time, before restoring it again last week.

Canvas is used by upwards of 9000 institutions, including universities, K-12 schools, and digital learning courses. 

ShinyHunters blocked access to the platform on May 7, replacing some organizations’ login page with a message to Instructure. It threatened the release of 3.65 terabytes of data if the ransom wasn’t paid by May 12th. The message also provided a route for affected schools to pay their own settlement to ShinyHunters to protect their data.

The School acted quickly to protect the community, electing to limit access to the platform. 

“Out of an abundance of caution, Brimmer restricted student access to Canvas for now,” Upper School Head Joshua Neudel said in an email to the community.

The School deemed this extra layer of protection necessary even though it does not use Canvas to store extremely sensitive information.

“We as a school don’t store all the parts of personally identified information in Canvas,” Neudel said. “We use single sign-on for [Microsoft] Office. So there’s no worry about passwords being breached.” 

However, some community members still expressed worries about the security of their data. Upper School Law Teacher Ken Levine feels that with the increasing development of technology, security is difficult for all platforms.

“Yes, [I was worried about the security of our data],” Levine said. “I don’t think we yet have effective ways to secure information. Not just Canvas, but I think across the board, [in] all aspects of the internet.”

The day after the hack, the site went back online for most schools, with many restoring access for their students. However, in the interest of keeping the community protected, the administration chose to keep it closed.

Neudel elaborated on the School’s decision, citing a lack of information from Instructure and possible future shutdowns as core reasons.

“We were immediately concerned about data and what could be happening, and we didn’t have a lot of information, so we decided to remove access from students,” Neudel said. “It wasn’t clear what was happening from Instructure, in terms of… whether there was going to be more disruptions or not. We decided we wanted to be consistent, because we didn’t want to tell people we’re going back to Canvas before we were confident that there weren’t going to be future disruptions.”

Director of Technology Jason Bock explained how the School’s decision compares to those of other institutions.

“Different schools took different philosophies on what to do,” Bock said. “Some aired on a side of ‘we need to get it [up], it’s a learning tool that people depend on, we need to turn it on as soon as possible.’ And then other schools are still not using it. We sort of fell in the middle.”

Despite cutting access for students, the School did continue to allow teachers to view their class materials.

“We did allow faculty to be able to see things, so that they could access and download, because we knew that was not part of the concerns with the data,” Neudel said.

The School kept the platform closed for a week, during which students and teachers were expected to continue on as usual, with assignments and class information being sent out by email. This quick adjustment caused issues for many students who found it difficult to adapt. Logan Lang ‘27 explained the struggles he had with the change.

“I found it very confusing, very hard,” Lang said. “It was much harder to keep track of my work. I didn’t know any of my grades. I felt like I was in the dark.”

Tyson Robinson ‘27 agreed with Lang, finding additional issues with receiving information from teachers.

“It’s really difficult to keep track of all your homework in an email,” Robinson said. “And some teachers, you know, they’re not used to doing that.”

Students were also unable to access study materials and past assignments, which were only available in Canvas, causing problems for some.

“For some classes, like my Spanish class, we store a lot of our study materials in Canvas,” Robinson said. “So we’ll have some articles or Blookets or vocab sheets [in Canvas]. Any of that stuff, you couldn’t get, or it was much harder to get.”

Teachers also needed to quickly get used to the change. Levine described how it affected educators’ ability to do their jobs. 

“It makes it more difficult to follow along with classwork and do grading and attendance,” Levine said. “Pretty much everything about the school day gets affected. I couldn’t really give assignments and monitor assignments, and I had to wait on the grading, which I think is frustrating sometimes for the students who would like to know [in] real time how they’re doing with their grades.”

On May 11, Instructure “reached an agreement with the unauthorized actor”, which experts believe to confirm the company’s payment of the ransom set by ShinyHunters. The firm’s statement also reassured users that all sensitive data had been returned to Instructure, and that it had been destroyed on ShinyHunters’ end. Two days later, the School decided to restore access to Canvas.

“When we looked at what other schools were doing, and there was no inherent additional risk, we had to kind of take the company at [its] word,” Neudel said.

However, the School still proceeded with caution, beginning with a limited version of the system and slowly expanding access to features.

“When people got access back they couldn’t do quite as much,” Bock said. “We started flipping switches on a little bit more slowly in terms of what especially teachers and administrators could do within the system. We’ve been just taking things cautiously.”

Neudel emphasized how necessary the platform was, especially with end-of-year projects and final exams on the horizon.

“We decided to open it back up because at [this] time of the year, we were feeling a lot of stress and anxiety from students and teachers about being able to access information in the modules, check their grades, [and] submit work,” Neudel said.

As for the future, the School still believes Canvas is a reliable option, and plans to continue using it while also looking into other learning management systems.

“There’s always going to be questions around security,” Neudel said. “Last year, PowerSchool had a hack and went through something similar with their major system… What we are getting from the experts is [that] this could happen to any number of learning management systems.”

Still, the School plans on assessing all possible options to ensure that the community uses the best, safest platform possible.

“Something that’s been on our to-do list is to look at learning management systems,” Bock said. “We were going to be looking at that anyway, so now we’re doubling down on that effort and really spending some time this summer to see what options are out there.”