×
The Best Digital Notebooks and Smart Pens, According to Our To-Do List Addict

The Best Digital Notebooks and Smart Pens, According to Our To-Do List Addict

Comparing Our Favorite Digital Notebooks

Our Favorite Smart Pens

Neo Smartpen M1+ for $129: Skip the tablet and write directly on paper with a smart pen instead. The Neo Smartpen M1+ is the thinnest and lightest of all the pens I tried, which makes it feel a bit more like your standard pen. Importantly, it’s comfortable to hold and use. You should be able to find whatever size and style of notebook you need as well as planners. The Neo Studio app (iOS, Android) is nice, with an easy-to-navigate notebook system and the ability to search for pages by page number or date. You can change the color of the ink and thickness of the lines right on the page as you go, or you can switch them up later and edit the colors of what you’ve written. —Medea Giodiano

Moleskine Smart Writing Set for $279: Moleskine has garnered a devoted following for its classic notebooks and journals, but it has also moved into smart territory. The Smart Writing Set gets you a notebook and pen bundle, so this is the best option for most people starting out. Write in the notebook and it’ll appear in the companion app! But you can buy the pen on its own, as well as the smart notebooks and planners in various sizes. The Moleskine Notes 2.0 app (iOS, Android) was easy to use once I settled into it. An older version of the app is available for download, but the 2.0 version is more streamlined. A pop-up let me know that 2.0 is still a work in progress and I might need to switch back to the older version if my device is having trouble, but my iPhone 11 didn’t have any issues. I tested the the $149 2018 version of the Smart Writing Set, which is no longer available, but we plan to test the latest version soon. —Medea Giordano

Honorable Mentions

Photograph: Iskn

Boox Note Air3 C for $450: This model was a solid all-around performer, and has a more complicated ecosystem than our top picks but has more capabilities to compare with a standard tablet. This version has been discontinued, but there’s a new version, the Note Air4 C ($530).

Neo Smartpen Dimo for $59: This is the cheapest smart pen option and uses replaceable batteries. It isn’t compatible with Google Calendar, iCal, or Outlook like our other picks.

Rocketbook Fusion Plus for $38: If you really prefer the paper experience and don’t want something you need to charge, then Rocketbook is for you. Rocketbook makes several reusable notebooks, planners, and accessories like index cards and sticky notes. I like the Rocketbook Fusion Plus since it comes with a ton of different template styles, from your classic monthly and weekly pages to project management layouts and meeting notes, making it feel closer to the variety a digital notebook can offer you. Take notes with an erasable Pilot Frixion Pen (one comes with whichever item you buy), scan photos of the pages into the Rocketbook app, and erase the whole thing with the damp microfiber cloth (also included). The app is designed to keep everything organized and easily send things off to Google Drive, Slack, Trello, OneNote, and a handful of other options.

Supernote A6 X2 Nomad for $329: This is a smaller version of the Supernote A5 X2 Manta, measuring almost 6 inches on one side and 7.5 inches on the other. Supernote designed it with travel in mind, but I find it to be a great size for a daily digital to-do list or writing down quick notes from a meeting. It’s too small for anything major, but if you’re looking for something compact, this is a good option with Supernote’s software (and with the same fantastic pens!). Like the Manta above, this model rose in price due to the tariffs, though it only went up $30.

FAQs

Do You Need a Digital Note-Taking Device?

The short answer is no. These devices are expensive, usually costing several hundred dollars when a simple notebook and pen costs a few bucks. But if you like the physical act of writing over typing but need to have digital copies, they’re worth considering.

Pros:

  • Digital notebooks are thin and light but hold hundreds of notes.
  • You can transcribe your notes into text files, making them easier to read and manipulate.
  • Depending on the device, you can export files as PDFs, Google Docs, Evernote files, and more.
  • Instantly digitizes your art too.

Cons:

  • Expensive.
  • Need to be charged.
  • Have a learning curve.
  • Most smart pens need to be paired with an accompanying notebook. The upcoming Nuwa Pen promises smart notes on any paper.

E Ink notebooks are easier on the eyes and feel closer to paper than a glass-screened tablet. But in some cases, you might spend less getting an iPad and an Apple Pencil (and a keyboard if you also want to type sometimes). You can also do more on them thanks to the thousands of apps in the App Store, but still take notes and draw. An iPad is pretty intuitive if you’re familiar with the Apple ecosystem (though both ReMarkable and Supernote’s ecosystems are also very intuitive). Former WIRED reviewer Jaina Grey recommended using her 11-inch iPad Pro with the GoodNotes and Notability apps for her writing, but there are other models that should work fine, including our top pick, the 2025 iPad. Check our our guide to the Best iPads for more advice on which to buy.

I also have an iPad, and I’ll say the upside of a digital notebook is the battery tends to last longer, especially if you’re the type to use it for a day or two and then forget about it for a few days. My trusty Kindle Scribe usually manages to have plenty of battery available for whenever I feel the note-taking itch, even if it’s been a week or two since I last touched it.

Why Are Digital Notebooks So Expensive?

Just because these devices look like paper doesn’t mean they’re as cheap to make as a sheet of paper. Like any tablet or smart phone, these devices are packed with features, a special ecosystem, and the e-ink technology is no small feat to perfect, along with a sensation similar to writing on paper. It’s an impressive feat of technology.

Prices haven’t gotten cheaper for this category in the wake of tariffs’ causing technology prices to rise. ReMarkable did recently raise the price of our top pick, the ReMarkable Paper Pro. Another favorite of ours from Supernote has gone up a little less than $50, and Kobo also slightly raised its prices, though the $10 increase is pretty minor compared to other increases we’ve seen. We’ll continue to monitor prices and flag if more price changes are to come.

Power up with unlimited access to WIRED. Get best-in-class reporting and exclusive subscriber content that’s too important to ignore. Subscribe Today.

Source link
#Digital #Notebooks #Smart #Pens #ToDo #List #Addict


French prosecutors who are investigating Elon Musk and his social media platform X have summoned the billionaire to France to face preliminary charges. The investigation is now officially a criminal probe, according to French officials.

France opened a probe in 2025 to investigate whether X has violated French law, an investigation that has expanded following incidents last year when Musk’s AI chatbot Grok started denying the Holocaust, praising Hitler, and allegedly generating child sexual abuse material when prompted by users.

According to the Wall Street Journal, Musk and former CEO Linda Yaccarino have been asked to travel to France to face preliminary charges. As the Journal explains, after preliminary charges have been filed in France, an investigating magistrate starts a process that can take months and doesn’t necessarily mean a trial will be held. It’s entirely possible that the case could ultimately be dropped.

French authorities are looking into the “complicity” of Musk in creating sexual abuse images of minors and sexually explicit deepfakes, according to the Associated Press. Grok also allegedly spread misinformation in French, including a claim that Auschwitz wasn’t a death camp during the Holocaust but was used for “disinfection with Zyklon B against typhus.”

Musk purchased Twitter in late 2022 and changed the name to X. The billionaire made many changes to the platform, stripping away safeguards that allowed people to know when an account was verified, and inviting back far-right figures who had previously been banned. Musk welcomed users like white supremacist Nick Fuentes and conspiracy theorist Alex Jones, among a host of others.

Musk also tinkered with the site in ways that turned it into a hotbed of far-right extremism and pro-Trump propaganda in the lead-up to the 2024 presidential election. Musk donated over $290 million to Republicans in the 2024 cycle and even ran a program that paid some voters in swing states up to $1 million to sign a “petition,” a move that was just very clearly an attempt at paying people to vote for Trump.

Musk, who is currently worth $803 billion, was rewarded with a job overseeing the dismantling of agencies in the federal government under the auspices of DOGE, the Department of Government Efficiency. Ultimately, about 300,000 government workers lost their jobs, and USAID was unlawfully dissolved. The cuts to global aid are estimated to lead to 23 million deaths by the year 2030, according to an analysis by The Lancet Global Health.

Last month, the U.S. Department of Justice told French authorities the U.S. wouldn’t assist in any investigation of Musk and X, something that wasn’t a surprise given the billionaire oligarch’s ties to the Trump regime.

“This investigation seeks to use the criminal legal system in France to regulate a public square for the free expression of ideas and opinions in a manner contrary to the First Amendment of the United States Constitution,” the April letter said, according to the Wall Street Journal.

X didn’t immediately respond to questions emailed Thursday about whether Musk planned on traveling to France. Gizmodo will update this article if we hear back.

#French #Prosecutors #Elon #Musk #Linda #Yaccarino #Face #Preliminary #ChargesElon Musk,Grok">French Prosecutors Want Elon Musk and Linda Yaccarino to Face Preliminary Charges
                French prosecutors who are investigating Elon Musk and his social media platform X have summoned the billionaire to France to face preliminary charges. The investigation is now officially a criminal probe, according to French officials. France opened a probe in 2025 to investigate whether X has violated French law, an investigation that has expanded following incidents last year when Musk’s AI chatbot Grok started denying the Holocaust, praising Hitler, and allegedly generating child sexual abuse material when prompted by users. According to the Wall Street Journal, Musk and former CEO Linda Yaccarino have been asked to travel to France to face preliminary charges. As the Journal explains, after preliminary charges have been filed in France, an investigating magistrate starts a process that can take months and doesn’t necessarily mean a trial will be held. It’s entirely possible that the case could ultimately be dropped.

 French authorities are looking into the “complicity” of Musk in creating sexual abuse images of minors and sexually explicit deepfakes, according to the Associated Press. Grok also allegedly spread misinformation in French, including a claim that Auschwitz wasn’t a death camp during the Holocaust but was used for “disinfection with Zyklon B against typhus.” Musk purchased Twitter in late 2022 and changed the name to X. The billionaire made many changes to the platform, stripping away safeguards that allowed people to know when an account was verified, and inviting back far-right figures who had previously been banned. Musk welcomed users like white supremacist Nick Fuentes and conspiracy theorist Alex Jones, among a host of others.

 Musk also tinkered with the site in ways that turned it into a hotbed of far-right extremism and pro-Trump propaganda in the lead-up to the 2024 presidential election. Musk donated over 0 million to Republicans in the 2024 cycle and even ran a program that paid some voters in swing states up to  million to sign a “petition,” a move that was just very clearly an attempt at paying people to vote for Trump.

 Musk, who is currently worth 3 billion, was rewarded with a job overseeing the dismantling of agencies in the federal government under the auspices of DOGE, the Department of Government Efficiency. Ultimately, about 300,000 government workers lost their jobs, and USAID was unlawfully dissolved. The cuts to global aid are estimated to lead to 23 million deaths by the year 2030, according to an analysis by The Lancet Global Health. Last month, the U.S. Department of Justice told French authorities the U.S. wouldn’t assist in any investigation of Musk and X, something that wasn’t a surprise given the billionaire oligarch’s ties to the Trump regime.

 “This investigation seeks to use the criminal legal system in France to regulate a public square for the free expression of ideas and opinions in a manner contrary to the First Amendment of the United States Constitution,” the April letter said, according to the Wall Street Journal. X didn’t immediately respond to questions emailed Thursday about whether Musk planned on traveling to France. Gizmodo will update this article if we hear back.      #French #Prosecutors #Elon #Musk #Linda #Yaccarino #Face #Preliminary #ChargesElon Musk,Grok

Wall Street Journal, Musk and former CEO Linda Yaccarino have been asked to travel to France to face preliminary charges. As the Journal explains, after preliminary charges have been filed in France, an investigating magistrate starts a process that can take months and doesn’t necessarily mean a trial will be held. It’s entirely possible that the case could ultimately be dropped.

French authorities are looking into the “complicity” of Musk in creating sexual abuse images of minors and sexually explicit deepfakes, according to the Associated Press. Grok also allegedly spread misinformation in French, including a claim that Auschwitz wasn’t a death camp during the Holocaust but was used for “disinfection with Zyklon B against typhus.”

Musk purchased Twitter in late 2022 and changed the name to X. The billionaire made many changes to the platform, stripping away safeguards that allowed people to know when an account was verified, and inviting back far-right figures who had previously been banned. Musk welcomed users like white supremacist Nick Fuentes and conspiracy theorist Alex Jones, among a host of others.

Musk also tinkered with the site in ways that turned it into a hotbed of far-right extremism and pro-Trump propaganda in the lead-up to the 2024 presidential election. Musk donated over $290 million to Republicans in the 2024 cycle and even ran a program that paid some voters in swing states up to $1 million to sign a “petition,” a move that was just very clearly an attempt at paying people to vote for Trump.

Musk, who is currently worth $803 billion, was rewarded with a job overseeing the dismantling of agencies in the federal government under the auspices of DOGE, the Department of Government Efficiency. Ultimately, about 300,000 government workers lost their jobs, and USAID was unlawfully dissolved. The cuts to global aid are estimated to lead to 23 million deaths by the year 2030, according to an analysis by The Lancet Global Health.

Last month, the U.S. Department of Justice told French authorities the U.S. wouldn’t assist in any investigation of Musk and X, something that wasn’t a surprise given the billionaire oligarch’s ties to the Trump regime.

“This investigation seeks to use the criminal legal system in France to regulate a public square for the free expression of ideas and opinions in a manner contrary to the First Amendment of the United States Constitution,” the April letter said, according to the Wall Street Journal.

X didn’t immediately respond to questions emailed Thursday about whether Musk planned on traveling to France. Gizmodo will update this article if we hear back.

#French #Prosecutors #Elon #Musk #Linda #Yaccarino #Face #Preliminary #ChargesElon Musk,Grok">French Prosecutors Want Elon Musk and Linda Yaccarino to Face Preliminary ChargesFrench Prosecutors Want Elon Musk and Linda Yaccarino to Face Preliminary Charges
                French prosecutors who are investigating Elon Musk and his social media platform X have summoned the billionaire to France to face preliminary charges. The investigation is now officially a criminal probe, according to French officials. France opened a probe in 2025 to investigate whether X has violated French law, an investigation that has expanded following incidents last year when Musk’s AI chatbot Grok started denying the Holocaust, praising Hitler, and allegedly generating child sexual abuse material when prompted by users. According to the Wall Street Journal, Musk and former CEO Linda Yaccarino have been asked to travel to France to face preliminary charges. As the Journal explains, after preliminary charges have been filed in France, an investigating magistrate starts a process that can take months and doesn’t necessarily mean a trial will be held. It’s entirely possible that the case could ultimately be dropped.

 French authorities are looking into the “complicity” of Musk in creating sexual abuse images of minors and sexually explicit deepfakes, according to the Associated Press. Grok also allegedly spread misinformation in French, including a claim that Auschwitz wasn’t a death camp during the Holocaust but was used for “disinfection with Zyklon B against typhus.” Musk purchased Twitter in late 2022 and changed the name to X. The billionaire made many changes to the platform, stripping away safeguards that allowed people to know when an account was verified, and inviting back far-right figures who had previously been banned. Musk welcomed users like white supremacist Nick Fuentes and conspiracy theorist Alex Jones, among a host of others.

 Musk also tinkered with the site in ways that turned it into a hotbed of far-right extremism and pro-Trump propaganda in the lead-up to the 2024 presidential election. Musk donated over $290 million to Republicans in the 2024 cycle and even ran a program that paid some voters in swing states up to $1 million to sign a “petition,” a move that was just very clearly an attempt at paying people to vote for Trump.

 Musk, who is currently worth $803 billion, was rewarded with a job overseeing the dismantling of agencies in the federal government under the auspices of DOGE, the Department of Government Efficiency. Ultimately, about 300,000 government workers lost their jobs, and USAID was unlawfully dissolved. The cuts to global aid are estimated to lead to 23 million deaths by the year 2030, according to an analysis by The Lancet Global Health. Last month, the U.S. Department of Justice told French authorities the U.S. wouldn’t assist in any investigation of Musk and X, something that wasn’t a surprise given the billionaire oligarch’s ties to the Trump regime.

 “This investigation seeks to use the criminal legal system in France to regulate a public square for the free expression of ideas and opinions in a manner contrary to the First Amendment of the United States Constitution,” the April letter said, according to the Wall Street Journal. X didn’t immediately respond to questions emailed Thursday about whether Musk planned on traveling to France. Gizmodo will update this article if we hear back.      #French #Prosecutors #Elon #Musk #Linda #Yaccarino #Face #Preliminary #ChargesElon Musk,Grok

French prosecutors who are investigating Elon Musk and his social media platform X have summoned the billionaire to France to face preliminary charges. The investigation is now officially a criminal probe, according to French officials.

France opened a probe in 2025 to investigate whether X has violated French law, an investigation that has expanded following incidents last year when Musk’s AI chatbot Grok started denying the Holocaust, praising Hitler, and allegedly generating child sexual abuse material when prompted by users.

According to the Wall Street Journal, Musk and former CEO Linda Yaccarino have been asked to travel to France to face preliminary charges. As the Journal explains, after preliminary charges have been filed in France, an investigating magistrate starts a process that can take months and doesn’t necessarily mean a trial will be held. It’s entirely possible that the case could ultimately be dropped.

French authorities are looking into the “complicity” of Musk in creating sexual abuse images of minors and sexually explicit deepfakes, according to the Associated Press. Grok also allegedly spread misinformation in French, including a claim that Auschwitz wasn’t a death camp during the Holocaust but was used for “disinfection with Zyklon B against typhus.”

Musk purchased Twitter in late 2022 and changed the name to X. The billionaire made many changes to the platform, stripping away safeguards that allowed people to know when an account was verified, and inviting back far-right figures who had previously been banned. Musk welcomed users like white supremacist Nick Fuentes and conspiracy theorist Alex Jones, among a host of others.

Musk also tinkered with the site in ways that turned it into a hotbed of far-right extremism and pro-Trump propaganda in the lead-up to the 2024 presidential election. Musk donated over $290 million to Republicans in the 2024 cycle and even ran a program that paid some voters in swing states up to $1 million to sign a “petition,” a move that was just very clearly an attempt at paying people to vote for Trump.

Musk, who is currently worth $803 billion, was rewarded with a job overseeing the dismantling of agencies in the federal government under the auspices of DOGE, the Department of Government Efficiency. Ultimately, about 300,000 government workers lost their jobs, and USAID was unlawfully dissolved. The cuts to global aid are estimated to lead to 23 million deaths by the year 2030, according to an analysis by The Lancet Global Health.

Last month, the U.S. Department of Justice told French authorities the U.S. wouldn’t assist in any investigation of Musk and X, something that wasn’t a surprise given the billionaire oligarch’s ties to the Trump regime.

“This investigation seeks to use the criminal legal system in France to regulate a public square for the free expression of ideas and opinions in a manner contrary to the First Amendment of the United States Constitution,” the April letter said, according to the Wall Street Journal.

X didn’t immediately respond to questions emailed Thursday about whether Musk planned on traveling to France. Gizmodo will update this article if we hear back.

#French #Prosecutors #Elon #Musk #Linda #Yaccarino #Face #Preliminary #ChargesElon Musk,Grok

ransomware gangs and data extortion attacks. But never before, perhaps, has a cyberattack against a single software platform so thoroughly disrupted the daily operations of thousands of schools across the United States.

The widely used digital learning platform Canvas was put into “maintenance mode” on Thursday after its maker, the education tech giant Instructure, suffered a data breach and faced an extortion attempt by attackers using the recognizable moniker “ShinyHunters.” Though the hackers have been advertising the breach and attempting to extract a ransom payment from Instructure since May 1, the situation took on additional immediacy for regular people across the US and beyond on Thursday because the Canvas downtime caused chaos at schools, including those in the midst of finals and end-of-year assignments.

Universities like Harvard, Columbia, Rutgers, and Georgetown sent alerts to students about the situation in recent days; other institutions, including school districts in at least a dozen states, also appear to have been affected. In a list published by the hackers behind the attack on their ransom-focused dark web site, they claim the breach affected more than 8,800 schools. The exact scale and reach of the breach is currently unclear, though. And the fact that Canvas was down throughout Thursday afternoon and evening further complicated the picture.

In a running incident update log that began on May 1, Steve Proud, Instructure’s chief information security officer, said that the company had “recently experienced a cybersecurity incident perpetrated by a criminal threat actor.” He added on May 2 that “the information involved” for “users at affected institutions” included names, email addresses, student ID numbers, and messages exchanged by users on the platform.

The situation was ultimately marked as “Resolved” on Wednesday, with Proud writing that “Canvas is fully operational, and we are not seeing any ongoing unauthorized activity.” At midday on Thursday, though, the Instructure status page registered an “issue” where “some users are having difficulties logging into Student ePortfolios.” Within a few hours, the company had added another status update: “Instructure has placed Canvas, Canvas Beta and Canvas Test in maintenance mode.” Late Thursday evening, the company said that Canvas was available again “for most users.”

TechCrunch reported on Thursday that the hackers launched a secondary wave of attacks, defacing some schools’ Canvas portals by injecting an HTML file to display their own message on the schools’ Canvas login pages. According to The Harvard Crimson, attackers modified the Harvard Canvas login page to show a message that included a list of schools that the hackers claim were impacted by the breach.

The message from attackers “urged schools included on the affected list to consult with a cyber advisory firm and contact the group privately to negotiate a settlement before the end of the day on May 12—or else risk their data being leaked,” The Crimson reported. “It is unclear what information tied to Harvard affiliates was included in the alleged breach.”

Instructure did not immediately respond to a request for comment about Thursday’s outages and how they fit into the bigger picture of the breach. But the situation is significant given that a massive trove of student information has potentially been exposed, and the visibility of the incident across the country makes it a key example of a longstanding, yet endlessly escalating problem of data extortion and ransomware attacks.

The ShinyHunters name is associated with massive data dumps and has been linked to the infamous hacker collective known as the Com. But as the constellation of actors has shifted over the years, numerous attackers have taken up the most prominent Com-related monikers. A number of recent attacks have invoked other names, such as Lapsus$, with little or no connection to the original group that operated under the name.

#Canvas #Hack #Kind #Ransomware #Debacleransomware,cybersecurity,malware,hacks,hacking,security,vulnerabilities">The Canvas Hack Is a New Kind of Ransomware DebacleHigher education has long been a target of ransomware gangs and data extortion attacks. But never before, perhaps, has a cyberattack against a single software platform so thoroughly disrupted the daily operations of thousands of schools across the United States.The widely used digital learning platform Canvas was put into “maintenance mode” on Thursday after its maker, the education tech giant Instructure, suffered a data breach and faced an extortion attempt by attackers using the recognizable moniker “ShinyHunters.” Though the hackers have been advertising the breach and attempting to extract a ransom payment from Instructure since May 1, the situation took on additional immediacy for regular people across the US and beyond on Thursday because the Canvas downtime caused chaos at schools, including those in the midst of finals and end-of-year assignments.Universities like Harvard, Columbia, Rutgers, and Georgetown sent alerts to students about the situation in recent days; other institutions, including school districts in at least a dozen states, also appear to have been affected. In a list published by the hackers behind the attack on their ransom-focused dark web site, they claim the breach affected more than 8,800 schools. The exact scale and reach of the breach is currently unclear, though. And the fact that Canvas was down throughout Thursday afternoon and evening further complicated the picture.In a running incident update log that began on May 1, Steve Proud, Instructure’s chief information security officer, said that the company had “recently experienced a cybersecurity incident perpetrated by a criminal threat actor.” He added on May 2 that “the information involved” for “users at affected institutions” included names, email addresses, student ID numbers, and messages exchanged by users on the platform.The situation was ultimately marked as “Resolved” on Wednesday, with Proud writing that “Canvas is fully operational, and we are not seeing any ongoing unauthorized activity.” At midday on Thursday, though, the Instructure status page registered an “issue” where “some users are having difficulties logging into Student ePortfolios.” Within a few hours, the company had added another status update: “Instructure has placed Canvas, Canvas Beta and Canvas Test in maintenance mode.” Late Thursday evening, the company said that Canvas was available again “for most users.”TechCrunch reported on Thursday that the hackers launched a secondary wave of attacks, defacing some schools’ Canvas portals by injecting an HTML file to display their own message on the schools’ Canvas login pages. According to The Harvard Crimson, attackers modified the Harvard Canvas login page to show a message that included a list of schools that the hackers claim were impacted by the breach.The message from attackers “urged schools included on the affected list to consult with a cyber advisory firm and contact the group privately to negotiate a settlement before the end of the day on May 12—or else risk their data being leaked,” The Crimson reported. “It is unclear what information tied to Harvard affiliates was included in the alleged breach.”Instructure did not immediately respond to a request for comment about Thursday’s outages and how they fit into the bigger picture of the breach. But the situation is significant given that a massive trove of student information has potentially been exposed, and the visibility of the incident across the country makes it a key example of a longstanding, yet endlessly escalating problem of data extortion and ransomware attacks.The ShinyHunters name is associated with massive data dumps and has been linked to the infamous hacker collective known as the Com. But as the constellation of actors has shifted over the years, numerous attackers have taken up the most prominent Com-related monikers. A number of recent attacks have invoked other names, such as Lapsus$, with little or no connection to the original group that operated under the name.#Canvas #Hack #Kind #Ransomware #Debacleransomware,cybersecurity,malware,hacks,hacking,security,vulnerabilities

gangs and data extortion attacks. But never before, perhaps, has a cyberattack against a single software platform so thoroughly disrupted the daily operations of thousands of schools across the United States.

The widely used digital learning platform Canvas was put into “maintenance mode” on Thursday after its maker, the education tech giant Instructure, suffered a data breach and faced an extortion attempt by attackers using the recognizable moniker “ShinyHunters.” Though the hackers have been advertising the breach and attempting to extract a ransom payment from Instructure since May 1, the situation took on additional immediacy for regular people across the US and beyond on Thursday because the Canvas downtime caused chaos at schools, including those in the midst of finals and end-of-year assignments.

Universities like Harvard, Columbia, Rutgers, and Georgetown sent alerts to students about the situation in recent days; other institutions, including school districts in at least a dozen states, also appear to have been affected. In a list published by the hackers behind the attack on their ransom-focused dark web site, they claim the breach affected more than 8,800 schools. The exact scale and reach of the breach is currently unclear, though. And the fact that Canvas was down throughout Thursday afternoon and evening further complicated the picture.

In a running incident update log that began on May 1, Steve Proud, Instructure’s chief information security officer, said that the company had “recently experienced a cybersecurity incident perpetrated by a criminal threat actor.” He added on May 2 that “the information involved” for “users at affected institutions” included names, email addresses, student ID numbers, and messages exchanged by users on the platform.

The situation was ultimately marked as “Resolved” on Wednesday, with Proud writing that “Canvas is fully operational, and we are not seeing any ongoing unauthorized activity.” At midday on Thursday, though, the Instructure status page registered an “issue” where “some users are having difficulties logging into Student ePortfolios.” Within a few hours, the company had added another status update: “Instructure has placed Canvas, Canvas Beta and Canvas Test in maintenance mode.” Late Thursday evening, the company said that Canvas was available again “for most users.”

TechCrunch reported on Thursday that the hackers launched a secondary wave of attacks, defacing some schools’ Canvas portals by injecting an HTML file to display their own message on the schools’ Canvas login pages. According to The Harvard Crimson, attackers modified the Harvard Canvas login page to show a message that included a list of schools that the hackers claim were impacted by the breach.

The message from attackers “urged schools included on the affected list to consult with a cyber advisory firm and contact the group privately to negotiate a settlement before the end of the day on May 12—or else risk their data being leaked,” The Crimson reported. “It is unclear what information tied to Harvard affiliates was included in the alleged breach.”

Instructure did not immediately respond to a request for comment about Thursday’s outages and how they fit into the bigger picture of the breach. But the situation is significant given that a massive trove of student information has potentially been exposed, and the visibility of the incident across the country makes it a key example of a longstanding, yet endlessly escalating problem of data extortion and ransomware attacks.

The ShinyHunters name is associated with massive data dumps and has been linked to the infamous hacker collective known as the Com. But as the constellation of actors has shifted over the years, numerous attackers have taken up the most prominent Com-related monikers. A number of recent attacks have invoked other names, such as Lapsus$, with little or no connection to the original group that operated under the name.

#Canvas #Hack #Kind #Ransomware #Debacleransomware,cybersecurity,malware,hacks,hacking,security,vulnerabilities">The Canvas Hack Is a New Kind of Ransomware Debacle

Higher education has long been a target of ransomware gangs and data extortion attacks. But never before, perhaps, has a cyberattack against a single software platform so thoroughly disrupted the daily operations of thousands of schools across the United States.

The widely used digital learning platform Canvas was put into “maintenance mode” on Thursday after its maker, the education tech giant Instructure, suffered a data breach and faced an extortion attempt by attackers using the recognizable moniker “ShinyHunters.” Though the hackers have been advertising the breach and attempting to extract a ransom payment from Instructure since May 1, the situation took on additional immediacy for regular people across the US and beyond on Thursday because the Canvas downtime caused chaos at schools, including those in the midst of finals and end-of-year assignments.

Universities like Harvard, Columbia, Rutgers, and Georgetown sent alerts to students about the situation in recent days; other institutions, including school districts in at least a dozen states, also appear to have been affected. In a list published by the hackers behind the attack on their ransom-focused dark web site, they claim the breach affected more than 8,800 schools. The exact scale and reach of the breach is currently unclear, though. And the fact that Canvas was down throughout Thursday afternoon and evening further complicated the picture.

In a running incident update log that began on May 1, Steve Proud, Instructure’s chief information security officer, said that the company had “recently experienced a cybersecurity incident perpetrated by a criminal threat actor.” He added on May 2 that “the information involved” for “users at affected institutions” included names, email addresses, student ID numbers, and messages exchanged by users on the platform.

The situation was ultimately marked as “Resolved” on Wednesday, with Proud writing that “Canvas is fully operational, and we are not seeing any ongoing unauthorized activity.” At midday on Thursday, though, the Instructure status page registered an “issue” where “some users are having difficulties logging into Student ePortfolios.” Within a few hours, the company had added another status update: “Instructure has placed Canvas, Canvas Beta and Canvas Test in maintenance mode.” Late Thursday evening, the company said that Canvas was available again “for most users.”

TechCrunch reported on Thursday that the hackers launched a secondary wave of attacks, defacing some schools’ Canvas portals by injecting an HTML file to display their own message on the schools’ Canvas login pages. According to The Harvard Crimson, attackers modified the Harvard Canvas login page to show a message that included a list of schools that the hackers claim were impacted by the breach.

The message from attackers “urged schools included on the affected list to consult with a cyber advisory firm and contact the group privately to negotiate a settlement before the end of the day on May 12—or else risk their data being leaked,” The Crimson reported. “It is unclear what information tied to Harvard affiliates was included in the alleged breach.”

Instructure did not immediately respond to a request for comment about Thursday’s outages and how they fit into the bigger picture of the breach. But the situation is significant given that a massive trove of student information has potentially been exposed, and the visibility of the incident across the country makes it a key example of a longstanding, yet endlessly escalating problem of data extortion and ransomware attacks.

The ShinyHunters name is associated with massive data dumps and has been linked to the infamous hacker collective known as the Com. But as the constellation of actors has shifted over the years, numerous attackers have taken up the most prominent Com-related monikers. A number of recent attacks have invoked other names, such as Lapsus$, with little or no connection to the original group that operated under the name.

#Canvas #Hack #Kind #Ransomware #Debacleransomware,cybersecurity,malware,hacks,hacking,security,vulnerabilities

Post Comment