NUS among Singapore institutions named in global data breach list
Sign up now: Get ST's newsletters delivered to your inbox
The attack blocked access to the Canvas learning platform.
ST PHOTO: KUA CHEE SIONG
SINGAPORE – A number of local institutions, including the National University of Singapore (NUS), has been named in a list of organisations allegedly hit by a global data breach seen online on May 8.
The other two Singapore institutions are the Singapore College of Insurance and the Institute of Singapore Chartered Accountants.
The Straits Times has contacted the three institutions for more information.
Thousands of institutions, including Harvard University and Stanford University, were hit by a massive cyberattack on May 7, following an earlier data breach.
The attack, which blocked access to Canvas learning platform, was claimed by ShinyHunters, a well-known cyber-extortion group active since at least 2019.
In a message allegedly sent by ShinyHunters and seen on forum platform Reddit, affected institutions are threatened with the release of stolen data.
“If any of the schools in the affected list are interested in preventing the release of their data, please consult with a cyber-advisory firm and contact us privately at TOX to negotiate a settlement,” read the statement.
Top stories
Explore top stories from all sections in one place
Singapore
10-year MOP for executive condos, more EC units for first-timers to tackle affordability concerns
Singapore
S’pore to pump $740m into tourism, rakes in record tourism spending of $32.8b in 2025
Singapore
New cruise and ferry terminal, exhibition hub in the works at Marina South
World
US and Iran exchange fire, but Trump says ceasefire still in effect
Asia
Penang has been DAP’s fortress since 2008. Could this end in the next polls?
Business
OCBC’s wealth business drives Q1 profit up 5% to $1.97 billion, more than expected
Asia
Run, snap, sell: Jakarta’s joggers fuelling post-pandemic street photography market
The institutions are provided a deadline of May 12 before “everything is leaked”.
The message included a link to a list of schools allegedly breached by the hackers through Canvas.
Instructure, the US-based education technology company behind the Canvas learning system, confirmed on May 2 that it had suffered a cyberattack.
“Indications are that the information involved consists of certain identifying information of users at affected institutions, such as names, e-mail addresses and student ID numbers, as well as messages among users.
“At this time, we have found no evidence that passwords, dates of birth, government identifiers or financial information were involved.”
In an update on May 6, the company said Canvas was fully operational, and “we are not seeing any ongoing unauthorised activity”.
