The digital economy has led to a U.S. trade surplus in services on the order of around 1% of gross domestic product. Yet recent advances in artificial intelligence have exposed new vulnerabilities that place every cyber system at risk of disruption. Cryptography has been crucial to protecting cyber systems. Using hashing or encryption, passwords can be protected, which has historically kept cyber systems safe from intruders. More recently, quantum computing has been viewed as a threat to shatter cyber system security, given its ability to unlock such systems in a reasonable amount of computing time. This has pushed the discovery of quantum-ready cryptography — cryptography that even quantum computers cannot break. This traditional model for protecting cyber systems is akin to installing an impenetrable lock on a house door to keep criminals from entering. AI systems that now exist effectively allow such people to enter the house through other means, without touching the house door that had become the focal point of protection. Enter Claude Mythos, a set of large language models created by Anthropic that can uncover cyber system security weak spots and even provide recommendations for fixes. Such vulnerabilities can let password protections be circumvented, or structural components of software code be identified that allows bad actors to sidestep cybersecurity protections, accessing data and other proprietary information. To date, Anthropic has not shared Claude Mythos publicly, but rather with large digital companies like Microsoft, Apple and Amazon, whose business models rely on robust cybersecurity. This was very responsible of Anthropic, but it does not change the underlying reality: The mere fact that AI systems have been created to penetrate cyber systems and circumvent security protections means that such systems will eventually be created by less honorable people and entities and used for nefarious purposes. This is why cyber
May 11, 2026 · via timesfreepress.com
A threat actor named Mr_Rot13 has been attributed to the exploitation of a recently disclosed critical cPanel flaw to deploy a backdoor codenamed Filemanager on compromised environments. The attack exploits CVE-2026-41940, a vulnerability impacting cPanel and WebHost Manager (WHM) that could result in an authentication bypass and allow remote attackers to gain elevated control of the control panel. According to a new report from QiAnXin XLab, the security defect has been exploited by a number of threat actors shortly after its public disclosure late last month, resulting in malicious behaviors like cryptocurrency mining, ransomware, botnet propagation, and backdoor implantation. "Monitoring data shows that more than 2,000 attacker source IPs worldwide are currently involved in automated attacks and cybercrime activities targeting this vulnerability," XLab researchers said. "These IPs are distributed across multiple regions globally, primarily originating from Germany, the United States, Brazil, the Netherlands, and other regions." Further analysis of the ongoing exploitation activity has uncovered a shell script that uses wget or curl to download a Go-based infector from a remote server ("cp.dene.[de[.]com") that's designed to implant a compromised cPanel system with an SSH public key for persistent access, along with dropping a PHP web shell that facilitates file upload/download and remote command execution. The web shell is then used to inject JavaScript code to serve a customized login page to steal login credentials and siphon them to an attacker-controlled system that's encoded using the ROT13 cipher ("wrned[.]com"). Once the details are transmitted, the attack chain culminates with the deployment of a cross-platform backdoor that's capable of infecting Windows, macOS, and Linux systems. The infector is also equipped to collect sensitive information from the compromised host, including bash history, SSH data, device information, database passwords, and cPanel virtual aliases (aka valiases), to a 3-member Telegram group created by a user
May 11, 2026 · via thehackernews.com
CybersecurityRise of Anthropic's Mythos spurs Japan to bolster cybersecurity on infrastructure
Prime minister to order new high-level effort to find vulnerabilities
Prime Minister Sanae Takaichi will call for a government-wide effort to identify risks in Japan's cyberdefenses. (Photo by Ken Suzuki)
TOKYO -- Prime Minister Sanae Takaichi will on Tuesday call for a cabinet-level effort to find cybersecurity weaknesses in Japan's infrastructure and reinforce them against the risk of such powerful new artificial intelligence tools as Anthropic's Mythos.
May 11, 2026 · via asia.nikkei.com
In today’s crowded cybersecurity market, independent analyst recognition matters. Bitsight was named a Leader in The Forrester Wave™: Cybersecurity Risk Rating Platforms, Q2 2026, and a Visionary in the 2026 Gartner® Magic Quadrant™ for Cyber Threat Intelligence Technologies — reinforcing Bitsight’s position as a trusted innovator as the industry evolves toward AI-driven, predictive cyber intelligence. Bitsight vs. Mandiant (Google): choosing the right fit for your risk program Bitsight Customer Reviews Bitsight vs. Mandiant (Google) Overview Bitsight's Customer Success and Support Bitsight differentiates from other security rating and third-party risk management providers with our world-class Customer Success team. Each Customer Success Manager (CSM) acts as a trusted advocate to ensure customers reach maximum value with Bitsight. Our Customer Support team is here to work with you and for you—when you’re on the clock with some of the most flexible hours of support in the industry, including live chat, comprehensive knowledge base and Bitsight Academy on-demand training. Proven Data Correlation & Accuracy The Bitsight Security Rating provides an objective, data-driven lens to view the health of an organization’s cyber security program. Bitsight data is independently verified to correlate with an organization’s risk of a security incident or data breach. See reports by AIR Worldwide, IHS Markit, Marsh McLennan, and Moody’s Analytics, demonstrating this critical connection. Per Moody's Analytics, Bitsight Analytics is also correlated to financial risk and firm value. Trust Matters Security leaders need solutions that help them identify and mitigate risks in their own organizations and broader third party supply chain, including vendors, suppliers, and business associates. Attackers continue to exploit known vulnerabilities and target critical third party suppliers to gain access to sensitive data or inflict operational harm. With the growing criticality of cybersecurity risk rating platforms in the global marketplace, trust and data accuracy matters. Bitsight is committed to
May 11, 2026 · via bitsight.com
Why It Matters A decade-old law that underpins how the federal government and private sector share cyber threat intelligence is set to expire September 30, and Congress has yet to chart a clear path forward on the CISA 2015 expiring provisions. A new Congressional Research Service report lays out the stakes plainly: let the Cybersecurity Information Sharing Act of 2015 lapse, and the legal scaffolding that encourages companies to share threat data with the government, and with each other, disappears with it. It's the legal basis for liability protections, antitrust exemptions, and disclosure shields that make private sector participation in threat-sharing programs possible. Without those protections, companies face real legal exposure for sharing information about breaches, intrusions, or vulnerabilities. The CRS report is direct about the consequence: "Without these protections, private sector entities may be less willing to share cyber threat information with the federal government and each other." The result, the report warns, could return the government to the exact problem that drove Congress to pass the law in the first place, operating without a complete picture of the cyber threats facing the country. Industry groups have already weighed in, broadly advocating for long-term renewal. The cybersecurity information sharing deadline is not a distant concern. Congress has roughly four months. The Bigger Picture Congress passed CISA 2015 as Title I of the broader Cybersecurity Act of 2015, responding to a recognized gap: private companies were reluctant to share information about cyberattacks, fearing lawsuits, antitrust exposure, or privacy liability. The law addressed that by authorizing private entities to monitor their own networks and share threat indicators with the federal government, while requiring the removal of personally identifiable information before any data changes hands. The operational engine of the framework is the Automated Indicator Sharing program, administered by the Department of
May 11, 2026 · via legis1.com
AI is upending the world of cybersecurity, as more capable models and agentic capabilities bring about new ways to exploit vulnerabilities, along with new ways to discover and patch them. While major US AI companies have so far led the race, Chinese...
The article requires paid subscription. Subscribe Now
May 11, 2026 · via digitimes.com
The UAE Cyber Security Council and Siemens have signed a Memorandum of Understanding (MoU) to deepen cooperation in cybersecurity across critical infrastructure and industrial sectors, addressing the imperative of securing operational technology environments across the UAE’s industrial landscape. Industrial sources added that this agreement, which was signed at the 2026 edition of Make it in The Emirates, establishes a strategic framework for joint action on cyber defense, knowledge sharing, and the development of locally hosted security capabilities, reinforcing the UAE’s position as a regional leader in digital resilience. Under the terms of the MoU, both entities aim to establish a Joint Innovation Center of Excellence. This facility will serve as a strategic hub dedicated to advancing Operational Technology (OT) cybersecurity research, fostering local talent development, and accelerating the deployment of next-generation security solutions within the UAE. H.E Dr. Mohamed Al Kuwaiti, Head of Cybersecurity for the UAE government stressed that: “The UAE under the direction of its leadership is committed to building a secure, innovation-driven digital economy. Our partnership with Siemens brings together global industrial cybersecurity expertise and our national vision to create a robust cyber defense ecosystem. This collaboration is part of the implementation of our National Cybersecurity Strategy to enhance our ability to detect, respond to, and recover from cyber threats across all sectors.” “Cybersecurity is not just a technology challenge, it is a foundation for economic competitiveness and national resilience,” said Mohamed Khalifa, Head of Digital Industries at Siemens in the Middle East. “This MoU with the UAE Cyber Security Council reflects our shared belief that securing critical infrastructure requires deep collaboration, local capability building, and world-class technology. Together, we are laying the groundwork for a more secure and sovereign digital future for the UAE.” Under the MoU, The UAE Cyber Security Council and Siemens intend to
May 11, 2026 · via intlbm.com
Welcome back to Extra Credit, a weekly roundup of education-related news from across Southwest and Southside Virginia. Have a story idea, tip or think there’s something I missed? Email me at meghan@cardinalnews.org. Thanks for reading! Cybersecurity incident affects schools, students across Virginia Several Virginia colleges, universities and K-12 school systems were among the victims of a cyberattack last week that left students locked out of assignments and resources. Hackers breached Instructure, the company behind Canvas, a platform used by schools across the world to manage assignments, track grades and deliver course content, Higher Ed Dive reported. The ed tech company confirmed the security incident Wednesday and even disabled access to the platform for a few hours Thursday. Virginia Tech, Virginia Commonwealth University and branches of the Virginia Community College System are among the higher ed users of Canvas in the state. Roanoke City Public Schools, which uses Canvas primarily for submitting assignments, advised staff and students to stay off the platform Friday. Alleghany Highlands Public Schools also sent out a notice about the breach Friday, but said there was “no evidence that AHPS systems were impacted.” As of Friday, the platform was up and running, and most users had regained access, but some school officials continued to warn users to be wary of suspicious activity, such as phishing attempts. Information impacted by the data breach includes messages between users, names, email addresses and student ID numbers, according to Higher Ed Dive. Instructure is continuing to investigate the incident but has not disclosed how many school systems or users were affected. Nottoway teacher is Virginia’s Teacher of the Year Madeline Duffy, a special education teacher at Nottoway High School in Nottoway County, was named this week as the 2027 Virginia Teacher of the Year. “Today, we celebrate an extraordinary educator who
May 11, 2026 · via cardinalnews.org
ZAWYA: UAE Cyber Security Council partners with ATRC CSC signs agreement with VentureOne to deploy advanced cybersecurity solutions including EQKD QuantumGate’s Crypto Discovery Tool supports one of the world’s first coordinated national post-quantum migration programs TII-developed national cryptographic libraries and quantum communications technology form the foundation of each solution Abu Dhabi, UAE – The UAE Cyber Security Council (CSC) yesterday signed an agreement with the Advanced Technology Research Council’s (ATRC) and its entities at Make it in the Emirates, that will accelerate the UAE’s transion to quantum safe security and strengthen national resilience against evolving cyber threats. The contract was consolidated between VentureOne, ATRC’s commercial arm and CSC, to deploy and scale cybersecurity solutions. This will support one of the world’s first coordinated national post-quantum migration plans. The solutions are based on cryptographic libraries developed by the Technology Innovation Institute (TII), QuantumGate’s Crypto Discovery Tool (CDT), and the Entanglement-based Quantum Key Distribution (EQKD) developed at TII and commercialized by VentureOne, and others. The expanded collaboration comes amid a period of heightened cyber risk globally and across the region, in addition to the longer-term challenge posed by quantum computing. H.E. Dr. Mohamed Al Kuwai, Head of Cyber Security for the UAE Government, said: “Preparing for the impact of quantum computing is a national priority. Strengthening our cryptographic foundations today ensures the long-term security of our digital infrastructure. Through our continued collaboration with TII, VentureOne, and QuantumGate, we are building resilient, future-ready cybersecurity capabilities that strengthen the UAE’s readiness for the quantum era while supporting a secure and coordinated national transition to post-quantum cryptography.” H.E. Shahab Issa Abu Shahab, Director General of ATRC, said: “The transition to quantum-safe security cannot wait until quantum threats arrive. The UAE must act now to strengthen the resilience of its digital infrastructure and critical systems. Through
May 11, 2026 · via tradingview.com
In the spring of 2025, U.S. colleges and universities awarded bachelor's degrees to more than 2 million students. Now, a new class of graduates is preparing to leave school, collect their degrees and face the same difficult-to-read job market the previous group did 12 months ago. These difficulties are especially true for members of the class of 2026 pursuing career opportunities in technology and cybersecurity. A look at the high-tech Silicon Valley sector shows fewer opportunities for graduates, combined with a high level of instability. In recent weeks, Oracle announced it would eliminate 30,000 jobs, while Meta — Facebook’s parent company — announced 8,000 layoffs, or about 10 percent of its workforce. While some of these tech firms are using artificial intelligence (AI) to fill entry-level IT and cybersecurity positions, many are slashing or reducing roles to readjust after hiring sprees during the COVID-19 pandemic. This also means tech and cybersecurity professionals are moving more between jobs rather than staying at large tech companies for years or decades to stay ahead of layoffs and keep their skill sets fresh. At the same time, however, there are signs of life within the U.S. job market for recent graduates. The Wall Street Journal reported that the National Association of Colleges and Employers expects organizations to increase new-graduate hires by 5.6 percent this year compared to 2025. Other research showed that unemployment among those ages 20 to 24 has recently dropped and that some high-tech firms, such as IBM, are planning on hiring more college and university graduates this spring. These numbers indicate that recent grads can still find work in their chosen field, especially in areas such as cybersecurity, where there remains a significant need for talent. Within the cyber market, there are more than 500,000 open positions listed by private firms
May 11, 2026 · via dice.com
LONGMONT, CO, May 11, 2026 /24-7PressRelease/ -- Charles Gifford has been selected for inclusion in Marquis Who's Who. As in all Marquis Who's Who biographical volumes, individuals profiled are selected on the basis of current reference value. Factors such as position, noteworthy accomplishments, visibility, and prominence in a field are all taken into account during the selection process. Mr. Gifford has established a distinguished career in cybersecurity, currently serving as the vice president and chief information security officer at Intrado Life & Safety Inc. in Longmont, Colorado, since 2024. In this capacity, he oversees the company's internal cyber program and all its products, ensuring the security of critical infrastructure that supports 911 services nationwide. Mr. Gifford's motivation stems from the essential nature of 911 as a national service, and he finds inspiration in knowing his work directly contributes to the safety and security of the country. Before joining Intrado Life & Safety Inc., Mr. Gifford held the position of Chief Information Security Officer at United Launch Alliance (ULA) in Denver from 2022 to 2024. During his tenure, he prepared the organization to achieve ISO 27001 certification and laid the foundation for compliance with CMMC 2.0, a U.S. Department of Defense requirement that ULA now meets. Mr. Gifford's leadership was instrumental in advancing the company's cybersecurity posture during a period of significant regulatory change. From 2020 to 2022, Mr. Gifford served as the Global Director of information technology security at Ball Corporation in Broomfield, Colorado. He played a pivotal role in the integration of Rexam following its $8.5 billion acquisition by Ball Corporation, coordinating with regulators across the U.S., Europe and South America to maintain robust security throughout the process. Mr. Gifford's earlier roles at Ball Corporation included global technical lead for operations and manager of global information technology security operations
May 11, 2026 · via 24-7pressrelease.com
Australia’s corporate regulator has urged the country’s financial sector to take urgent action on tackling potential cyber risks from frontier AI systems such as Mythos. The Australian Securities and Investments Commission on Friday published a letter sent to the financial services industry saying greater action needed to be taken to ensure cybersecurity practices were as strong as possible. ASIC Commissioner Simone Constant said the regulator had realized preparedness of Australian financial services organizations varied widely, but more work needed to be done to keep pace with frontier AI changes. Related: White House Prepares Order to Boost AI Security, Hassett Says “It’s always been the case that we have said you need to look at your end-to-end risk profile, your aggregate risks and vulnerabilities,” Constant told Reuters. “But instead of having a 12-month time horizon, there is now the potential for those risks to emerge incredibly quickly. “The worry is someone in a garage somewhere, not a state-based actor, can bring those things together quickly and weaponise them.” Macquarie chief executive Shemara Wikramanayake said the bank was working on substantial technology programs to test its potential risks against frontier AI models. Related: ‘The Arms Race Is On’: Chubb’s Greenberg on Mythos, Middle East “You don’t just press a button and find these vulnerabilities and Mythos has found a lot of vulnerabilities that have been there for years in so many things,” she said in an interview. “The risk for the world is if others manage to replicate that before they roll out protection.” Figuring Out Vulnerabilities Anthropic has launched Claude Mythos Preview under Project Glasswing, a tightly restricted access program that includes major technology firms such as Amazon, Microsoft, Nvidia and Apple. Wikramanayake said while Anthropic was working with some of the world’s largest companies to test Mythos, major businesses not
May 11, 2026 · via claimsjournal.com
By Adrian Hia Running a small business today means operating with very little room for slack. Owners are not just managing growth but making constant trade-offs, between hiring and automation, expansion and cost control and what feels urgent versus what is simply important. Staying lean is not a strategy – it’s just reality. Expenses are stretched and every investment is expected to deliver returns quickly. What keeps the business moving takes priority; what feels less immediate is pushed down the list – not ignored, just not today’s problem. Some risks naturally fall into that category. They sit at the back of the mind – part of the conversation, but not always part of the decision. Not because business owners underestimate the risks, but the impact is not always visible. At least, not until it is. Growth through going digital As businesses juggle these decisions being made, the environment around them has shifted too. Going digital is no longer just about efficiency, but access – to customers, to markets and to new ways of working. From digital payments and e-commerce platforms to cloud-based accounting and hybrid operations, much of running a business now sits online. For many SMEs, this shift was not gradual. It happened quickly, driven by the need to stay competitive, meet customer expectations, or comply with evolving requirements such as e-invoicing. As adoption accelerates, complexity follows. More devices, more systems, more touchpoints and more data moving across them. While businesses have adapted to this growing digital environment, the way risks are understood and managed has not always kept pace. This gap creates room for things to go wrong, often unnoticed and only surfacing when something stops working. As risk moves into daily operations According to the latest Kaspersky Security Network (KSN) data, over 3.3 million web attacks targeting
May 11, 2026 · via bernama.com
About
Press
Copyright
Contact us
Creators
Advertise
Developers
Terms
Privacy
Policy & Safety
How YouTube works
Test new features
NFL Sunday Ticket
© 2026 Google LLC
May 11, 2026 · via youtube.com
Australia to embed cyber security adviser in Samoa Australia will soon embed a cybersecurity adviser within Samoa’s Ministry of Communications and Information Technology (MCIT) as part of efforts to strengthen the country’s digital security capability. The announcement was made in the keynote address by Australia’s Deputy High Commissioner to Samoa, Simon Dawkins, during the launch of the Cyber Safety Outreach Week at the Tui Atua Tupua Tamasese Efi (TATTE) building in Sogi on Sunday evening. “We’ll soon have an Australian Advisor on cyber security embedded in the Ministry of Communications and Information Technology,” Dawkins said. He said the initiative followed this year's signing of a Memorandum of Understanding (MOU) on cyber cooperation between Australia's Foreign Minister Penny Wong and Samoa. Under the Samoa-Australia Policing Partnership, Dawkins said the Australian Federal Police had also supported the Samoa Police, Prisons and Corrections Services in launching a cybercrime unit last year. “Under the Samoa-Australia Policing Partnership, the Australian Federal Police supported the Samoa Police Prisons and Correction Services to launch their cyber crime unit, ensuring that Samoa is prepared, equipped and capable of protecting its people in the digital space,” he said. Dawkins said cybersecurity and cybersecurity threats continued to grow across the region and stressed the importance of cooperation between Pacific nations and development partners. He also spoke about the risks young people face online, including cyberbullying and online exploitation. “As the father of two young boys, I’m certainly alert to the risks emanating from the online domain,” he said. Dawkins cited Australia's social media minimum-age regulations to ban all under-16s from using age-restricted platforms. Prime Minister Laaulialemalietoa Leuatea Schmidt, in his keynote address, said technology continued to shape how people live, learn and connect, but warned there were also growing online dangers affecting communities. He said, "Times are different from those
May 11, 2026 · via samoaobserver.ws
User perceptions and behaviours regarding cybersecurity are critical factors in the success of digital banking in West Africa; more than half will adopt and regularly use digital banking services when they have a very strong degree of trust in the provider and that their financial assets are protected from risk. This goes especially true in a region with a high percentage of unbanked individuals, who probably are naturally inclined not to use any new technologies involving finances. Several variables can have a substantial impact on how users p
User perceptions and behaviours regarding cybersecurity are critical factors in the success of digital banking in West Africa; more than half will adopt and regularly use digital banking services when they have a very strong degree of trust in the provider and that their financial assets are protected from risk. This goes especially true in a region with a high percentage of unbanked individuals, who probably are naturally inclined not to use any new technologies involving finances. Several variables can have a substantial impact on how users p
May 11, 2026 · via businessday.ng
Security teams are turning to AI to survive alert overload The World Economic Forum white paper “Empowering Defenders: AI for Cybersecurity” identified AI as the biggest driver of change in cybersecurity for 94% of survey respondents. The paper found that 77% of organizations already use AI in cybersecurity, with much of the activity focused on phishing detection, anomaly monitoring, vulnerability management and incident response. “AI has the potential to shift the balance towards defenders,” said Akshay Joshi, Head of the Centre for Cybersecurity, World Economic Forum. “Organizations that treat it as a strategic capability instead of a standalone tool will be better placed to turn growing cyber risk into resilience and competitive advantage.” AI is moving deeper into security operations Security operations centers are changing quickly as teams push more alert handling and investigation work into automated systems. AI tools are being used to filter alerts, summarize investigations and help analysts process large volumes of telemetry and threat data. The report noted that 76% of cybersecurity professionals reported exhaustion in 2025, and 55% of teams reported understaffing. Threat detection remains one of the most common deployment areas. Security tools are examining communication patterns, language cues and impersonation tactics to identify suspicious messages and unusual behavior that older detection methods may miss. Software and cloud security teams are folding automated analysis into routine vulnerability and configuration reviews. Development and infrastructure teams are using AI to identify insecure code, detect configuration weaknesses and prioritize vulnerabilities in large environments. Operational pressure behind adoption is growing on both sides of the threat landscape. Attackers are using automation to speed up reconnaissance, malware development and large-scale campaigns. Defensive teams are pushing more analysis and investigation work into automated systems. Organizations using AI extensively in security shortened breach lifecycles by approximately 80 days and reduced average
May 11, 2026 · via helpnetsecurity.com
About
Press
Copyright
Contact us
Creators
Advertise
Developers
Terms
Privacy
Policy & Safety
How YouTube works
Test new features
NFL Sunday Ticket
© 2026 Google LLC
May 11, 2026 · via youtube.com
Nationwide security incident involving Canvas Share This Article Updated May 9, 2026 The University of California continues assessing updates from Instructure and cybersecurity partners regarding the recent Canvas security incident. Based on the latest information available, campuses and locations are evaluating next steps regarding restoration of Canvas services. Additional updates and campus-specific information will be shared through local communications channels as more information becomes available. As always, we encourage community members to remain vigilant regarding potential phishing attempts or suspicious communications. Updated May 8, 2026 Now that Instructure has advised that the incident has been contained and remediated, UC is making risk-based decisions about when to restore access to Canvas at campuses based on their operational needs. UC will continue to work closely with its IT teams across the system and determine next steps based on updates from Instructure. We understand the disruption this incident has caused for students, faculty, and staff. We will continue to monitor the situation and share additional information as it becomes available. Updated May 7, 2026 The University of California is closely monitoring the security incidents involving Instructure, the maker of learning management system Canvas used by thousands of educational institutions globally. Across our locations, we are aware that the Canvas login page displayed a suspicious message originating from the threat actor. The Instructure Security Incident Update & FAQs page provides information about what happened and how Instructure is responding. As always, we encourage our community members to remain vigilant and exercise caution regarding potential phishing attempts. Watch for unexpected messages that seem to come from UC. The university will never ask for passwords, Social Security numbers, birthdates, or bank account information through email, text, or phone calls. Out of an abundance of caution, the University of California Office of the President has instructed all
May 10, 2026 · via ucnet.universityofcalifornia.edu
All students, staff may be affected by Canvas breach in Needham, superintendent says Wellesley High School also among affected institutions Wellesley High School also among affected institutions Wellesley High School also among affected institutions Officials in Needham, Massachusetts, are "operating under the assumption that all students and staff were affected" by a cybersecurity incident affecting Canvas, software used widely across schools and colleges. Superintendent Dan Gutekanst of Needham Public Schools wrote in a statement that the district learned of the breach May 1 and learned May 7 that data from the district had been downloaded. The district was also notified of a second breach May 7, he said. According to Gutekanst, the information accessed included first names, last names and email addresses for all Needham Public Schools students and staff. Instructure, Canvas’ parent company, said it detected unauthorized activity April 26 and "immediately revoked the unauthorized party's access" and started an investigation. Instructure on Thursday identified additional unauthorized activity tied to the same incident. "The unauthorized actor made changes to the pages that appeared when some students and teachers were logged in through Canvas. Out of caution, we temporarily took Canvas offline into maintenance mode to contain the activity, investigate, and apply additional safeguards," a spokesperson said. Additionally, Gutekanst said the district was informed that teacher gradebook data connected to our PowerSchool student information system could have been modified." Wellesley High School is also a Canvas client, and district officials said the campus is among approximately 9,000 affected institutions. Response to the breach Gutekanst said NPS disconnected Canvas from PowerSchool "to prevent any further potential compromise of data or systems." According to the superintendent, the district requested a complete report on the incident from Instructure. It asked that the report include information about what data was breached or modified. "We
May 10, 2026 · via wcvb.com