University Digitalisation a ‘Hack’

The cybersecurity breach of online learning platform Nuku has caused alarm for students and staff alike, calling Te Herenga Waka’s reliance on digitised learning into question.

Reports indicate that Instructure, the company that owns Canvas, and the software on which Nuku runs, were made aware of a “cybersecurity incident perpetrated by a criminal threat actor” on 1 May 2026, that was “contained” by the following day.

On Wednesday 6 May, the University informed students and staff that the online learning portal had suffered an “incident,” and that some personal information may have been accessed. 

The announcement read that “it is possible that names, email addresses and student ID numbers may have been disclosed.” And that “It is also possible that the content of messages exchanged in Nuku are included in the data.” 

This update came four days after the first statement from Instructure. The university was officially made aware of their involvement in the hack on Monday 4 May, two days prior to notifying students and staff. 

By the morning of Friday 8 May, Nuku had been disabled, with the university predicting that the earliest time the service would be back online would be 8am on Wednesday 13 May, five days later.

On the same day, it became known that hackers had taken roughly 3.65 terabytes of student and staff data from 8809 institutions globally, with Auckland University of Technology and the University of Technology also affected within New Zealand.

The group, under the name ShinyHunters, issued a ransom request that read; “If any of the schools in the affected list are interested in preventing the release of their data, please consult with a cyber advisory firm and contact us privately at TOX to negotiate a settlement.”

ShinyHunters had previously breached Instructure in 2024, and were also responsible for hacking Ticketmaster that same year.

This time, an estimated 275 million users were affected, with the main concern being targeted phishing emails, scams, and identity fraud. Instructure does not believe birthdates, passwords, government identifiers, or financial information were impacted.

Nuku was restored on Monday 11 May, following reassurance from Instructure that the platform was safe to use.

It became known on Wednesday 13 May that Instructure had “reached an agreement with the unauthorised actors,” which cybersecurity professionals suggest indicates that at least some of the ransom was paid out. This remains unconfirmed by the company. 

Instructure insists that they have received “shred logs” as digital confirmation that copies of user’s data has been destroyed, but experts warn that criminal assurances that data won’t be sold on is unreliable, and users should remain cautious.

The incident is believed to be the largest recorded education-sector breach in history, and created significant disturbance for students, tutors, and lecturers alike. 

A tutor told Salient: “we got a lot of concerned emails from students right off the bat, especially in the lead up to exams, as Nuku is their go-to resource.”

“We’re definitely seeing a little less preparation for the tutorials earlier in the week, just because they couldn’t access the resources, and of course that impacts teaching and engagement.”

She says she was lucky to have a responsive course manager, who sent a comprehensive email detailing the way forward, but knows that “it was not the case for all courses.” 

Senior lecturer Dr Angi Buettner says that the Nuku outage has “added a lot of confusion and stress” to what is already a difficult time in the trimester. She says that when her course materials were suddenly not accessible, her teaching process was endangered. 

Her co-convenor Dr Lewis Rarm emphasised that “first-year students seem to be more alarmed,” and that disruptive events such as this one “provoke more anxiety in students.” 

Together, they have pushed back the deadline for an assignment that was originally due on Monday 11 May, so that students have more time to access resources. At the time, they couldn’t be certain that Nuku would even be back up and running in time for students to submit their assessments on Wednesday 13 May. 

Senior lecturer Dr Emma Tennent also provided her course with a blanket extension, because they were unable to access feedback from previous assignments. She said the outage posed challenges for her tutors as “they were not able to finish grading and upload feedback in the time they had allocated.” 

“As lecturers, we have been encouraged to put our material on Nuku to the extent where I don’t have full backups of all my course material outside the platform.”

“It was really a wakeup call for me about how dependent we—both the university and tertiary educators more widely—are dependent on these platforms over which we have so little control.”

As with Buettner and Rarm, Associate Professor Dr Nikki Hessel shares this sentiment. 

“We are all better off with books in our hands, pens at the ready, and sitting together in community. Incidents like this only make me more sure of that.”

When contacted for comment, the University delayed answering questions regarding reconsideration of digitised systems, citing that it is still an active incident.