Canvas 學習平台經免費教師帳號 XSS 遭入侵，師生帳號與訊息外流、登入頁被植勒索訊息

“When a customer service agent accessed the ticket, the code triggered a cross-site scripting (XSS) vulnerability, allowing the threat actor to obtain an authorization token and gain elevated access within the Canvas application.”

“According to ShinyHunters, the Instructure breach impacts 8,809 educational organizations (schools, universities, colleges, online platforms) and the hackers claim to have stolen 275 million records belonging to students, teachers, and other staff members.”

“On Tuesday, education tech giant Instructure disclosed a data breach where hackers stole students’ private information, including their names, personal email addresses, and messages sent between teachers and students.”

“公署表示，事故通報涉及7間教育機構，實際只影響4間，包括城大、科大、香港演藝學院及香港建造學院，至少有超過15萬人受影響，洩露的個人資料包括姓名、電郵地址、學生編號及或所修讀課程等。”

“目前已核實的外洩資料方面，城大涉及146,969名學生及員工的姓名、電郵地址、用戶名稱、學生編號及／或修讀課程資料；演藝學院涉及4,584名學生及員工的姓名、電郵地址、用戶／學生編號及／或修讀課程資料；建造學院涉及2,333名學生及員工的姓名、電郵地址及用戶／登入編號。”