A national security breach of online education platform Canvas shut down the site for Los Altos High School students yesterday. The breach is the second in just a week where hacker group ShinyHunters accessed student information — names, IDs, school emails and direct messages with teachers through the platform. While parent platform Instructure confirmed Canvas is currently safe to use, Director of IT Services Bob Fishtrom advised students and staff to stay skeptical of unfamiliar links they may encounter on the app. 

“First thing I tell people: if you don’t know who the sender is, or if it’s too good to be true, don’t click on it,” Fishtrom said. 

At 2:41 p.m yesterday, Canvas was shut down for seven hours — a preventative measure taken by the app in response to a security breach. Shortly after, ShinyHunter spread a statement claiming Instructure had five days to comply with demands before affected school’s data would be released. 

While many students experienced the Canvas shutdown yesterday, an initial security breach of the platform occurred last Friday, May 1. Fishstrom said he was notified by Instructure, and posted a message on ParentSquare Wednesday that the District was monitoring the situation. In a ransom note released around the same time, ShinyHunters claimed to have accessed more than 275 million users’ data. In previous security breaches, Fishstrom said he’s been advised by the FBI not to comply with demands, as doing so only increases the chances hackers will try again. 

While Canvas is also integrated with Aeries — LAHS’s student information systems platform —- Fishtrom said the connection has since been reset to prevent a corresponding security breach. Fishtrom added that sensitive personal information was never stored in Canvas itself in the first place.

“We can tell you with confidence that we do not store passwords in Canvas,” Fishtrom said. “We do not store your birthdate, Social Security number or any financial information. The same goes for teachers.” 

Specifically, Fishtrom advised students not to click on links ShinyHunter circulates — including a list of affected schools released in the latest message.