The attack blocked access to the Canvas learning platform.

SINGAPORE – A number of local institutions, including the National University of Singapore (NUS), has been named in a list of organisations allegedly hit by a global data breach seen online on May 8.

The other two Singapore institutions are the Singapore College of Insurance and the Institute of Singapore Chartered Accountants.

The Straits Times has contacted the three institutions for more information.

Thousands of institutions, including Harvard University and Stanford University, were hit by a massive cyberattack on May 7, following an earlier data breach.

The attack, which blocked access to Canvas learning platform, was claimed by ShinyHunters, a well-known cyber-extortion group active since at least 2019.

In a message allegedly sent by ShinyHunters and seen on forum platform Reddit, affected institutions are threatened with the release of stolen data.

“If any of the schools in the affected list are interested in preventing the release of their data, please consult with a cyber-advisory firm and contact us privately at TOX to negotiate a settlement,” read the statement.

The institutions are provided a deadline of May 12 before “everything is leaked”.

The message included a link to a list of schools allegedly breached by the hackers through Canvas.

Instructure, the US-based education technology company behind the Canvas learning system, confirmed on May 2 that it had suffered a cyberattack.

“Indications are that the information involved consists of certain identifying information of users at affected institutions, such as names, e-mail addresses and student ID numbers, as well as messages among users.

“At this time, we have found no evidence that passwords, dates of birth, government identifiers or financial information were involved.”

In an update on May 6, the company said Canvas was fully operational, and “we are not seeing any ongoing unauthorised activity”.