GSA Lost Email on the Same Date as Its First Fire

Glasgow School of Art cut staff and students off from email on the weekend of 23 May. The lockout landed as degree show week began, the moment the school sells itself to galleries and employers. Twelve years earlier, on 23 May 2014, a projector in a basement studio set off the first Mackintosh fire while students prepared that year’s show.

A GSA spokesperson called the 2026 incident “some temporary IT disruption over the weekend” and said the IT team was “investigating the cause.” Systems, the school added, were “now returning to normal.” It would not say whether this was a cyber attack.

Staff Lined Up on Rose Street for New Passwords

On Garnethill, the failure was not a quiet glitch. Staff queued outside the Rose Street finance and IT offices to have passwords reset in person. Email was dead. Other GSA online services were dead with it.

Eight people on campus described the same lockout. An interaction design student said he had “no access to communication” from GSA about what caused it. Two marketing staffers called the mess “an inconvenience” and played down any wider hit.

Two students leaving Rose Street were blunter. They called it a “big” cyber attack that was not aimed at GSA, and they blamed Canvas, the learning platform the school uses for reading lists and technical support. That was the only public education hack anyone on the hill could name. It does not match the calendar.

Why the Canvas Timeline Does Not Fit

Canvas, run by Utah-based Instructure, was breached in late April. ShinyHunters, a theft-and-extortion group, claimed it took 3.65 TB of data covering 275 million records across 8,809 institutions. Instructure has said the stolen material included names, email addresses, student ID numbers, and messages, and that it found no evidence passwords, dates of birth, government IDs, or financial data were taken.

The company detected the intrusion on 29 April. On 7 May the group defaced login pages at about 330 schools and Instructure took Canvas offline. On 11 May Instructure said it had reached an agreement with the unauthorized actor: the data was “returned,” it received “digital confirmation of data destruction (shred logs),” and it was told no customer would be extorted. The group’s leak deadline had been 12 May.

GSA’s email lockout was the weekend of 23 and 24 May. Canvas was already back. The ransom standoff was already closed. A local password queue looks like an identity reset, not a second ShinyHunters raid on Garnethill. The school still would not say so.

TWO CLOCKS, ONE WEEK

The UK Cyber Monitoring Centre later put about 160 UK higher education institutions in the Canvas blast radius, about 70 universities, 50 colleges, and 40 specialist schools. It found no evidence the attackers moved from Canvas into other campus systems. Disruption, it said, was generally short. The event sat below the centre’s Category 1 bar of £10m in losses. That is the wider Canvas breach across education campuses, and it does not explain a GSA email outage two weeks after the deal.

Degree Show Week Is When the School Breaks

GSA has a habit of losing the kit that holds student work at the exact moment that work is meant to be public. The 2026 outage did not burn a building. It still landed on the same week, and almost on the same date, as the fire that made the school infamous.

WHEN THE SCHOOL HAS GONE DARK

1. 23 May 2014: Fire starts shortly before 12:30 in a basement studio as final-year students prepare the degree show. Expanding-foam gases hit a hot projector. The Mackintosh library is lost.
2. 12 June 2014: The school stages a delayed showcase. The 102 fine art students whose work was hit each submit a digital print.
3. 15 June 2018: A second fire is reported at 11:19pm. First appliances arrive in 6 minutes. At its height more than 120 firefighters attend. Half the building is well alight within 38 minutes. Operations run 10 days. The cause is never found.
4. 23-24 May 2026: Staff and students lose email and other GSA online services. Passwords are reset in a queue on Rose Street. The school calls it temporary disruption.
5. 29 May 2026: Degree Show 2026 opens across Garnethill anyway.

The Scottish Fire and Rescue Service later published the investigation into the 2018 Mackintosh fire, the most complex probe it had led. It could not name a cause. In July 2026 the school said it could not fund a faithful rebuild of the Mackintosh building on its own. The physical wound is still open. So is the digital one.

The School Mirrored Its Data Centres After Two Fires

After the blazes, GSA wrote itself a continuity lesson. A school lessons-learnt report said IT services were maintained through both fires. Completion of the Stow Building, it said, gave the school two data centres a distance apart, in Stow and Reid, mirrored against each other.

That design is a fire plan. It keeps student files if one building burns. It does nothing if the lock is on identity, on Microsoft sign-in, or on a vendor the size of Instructure. The 2026 failure was a password problem. People walked to Rose Street with proof of who they were because the digital door had shut.

Instructure later said the Canvas hole sat in Free-for-Teacher accounts, a free tier it then shut for good. CrowdStrike worked the forensics. That was not in the GSA statement. Campus talk filled the gap with Canvas because Canvas was the scare everyone had already seen.

600 Students Still Opened on Time

The physical show did not wait for a full account. Degree Show 2026 ran Friday 29 May to Sunday 7 June across the Reid, Bourdon, Haldane, and Stow buildings. A digital showcase went live the same afternoon. The MFA show followed in the Stow Building from 13 to 21 June.

Degree Show is the most important moment in the GSA’s yearly calendar, transforming our campus into an expansive gallery that welcomes the city into our creative community.

Professor Penny Macbeth, Director and Principal, The Glasgow School of Art

Macbeth, in the school’s own notice that the most important moment in the GSA calendar had arrived, also said nearly 60% of graduates stay in Glasgow. Over 600 students from four schools were on the walls.

WHAT STILL WENT UP

• The dates: Undergraduate and taught-show rooms opened 29 May and ran through 7 June, weekdays 10:00 to 20:00 and weekends 10:00 to 18:00.
• The rooms: Fine art, design, architecture, and innovation and technology spread across four Garnethill buildings after the Mackintosh shell was lost.
• The parallel show: A digital showcase launched on 29 May so work could be seen if a visitor never got through the door.
• The MFA follow-on: Master of Fine Art work had its own run in the Stow Building from 13 June.

Work that needed a live network was the soft spot. Interaction design, immersive systems, and anything that pulled from campus accounts sat behind the same login that had just failed. The school’s public line did not separate a Canvas glitch from a full identity freeze. Students hanging work in Stow had no official sentence to give a visiting dealer.

Instructure Began Sending Stolen Files to Campuses in July

The vendor story did not end in May. Instructure spent June and July telling customers it would ship institution-specific packets of the stolen files through a secure link, after work with CrowdStrike and Charles River Associates. First-wave delivery of user and provisioning records was scheduled in mid-July. Message data was still under review, with a later drop planned.

That is the long tail of a deal sold as closure. Shred logs are not a proof the copies are gone. Cynthia Kaiser, a former deputy director of the FBI’s Cyber Division and now senior vice president at the Halcyon Ransomware Research Center, put the limit in one line.

What victims must understand is that payment does not end the threat. Stolen data will be used against clients and users for as long as it remains profitable to do so.

Cynthia Kaiser, senior vice president, Halcyon Ransomware Research Center

Instructure also said Canvas is used by 41% of higher education institutions in North America. GSA is a small specialist school on the other side of that market. It still had to reset people in the street because its own mail and campus logins had followed the vendor scare down.

The Art School Still Has Not Named a Cause

By 1 June the school’s line was unchanged: temporary disruption, an internal probe, systems coming back. No notice has since stated that GSA itself was breached, that Canvas was the trigger, or that the queues were a precaution after Instructure’s indicators of compromise. The gap is the story.

WHAT WE KNOW

• The outage: Staff and students lost GSA email and other online services on the weekend of 23 and 24 May, and staff queued on Rose Street for password resets.
• The school’s words: A spokesperson called it temporary IT disruption, said students and staff were being updated, and said the cause was under investigation.
• The show: Degree Show 2026 opened on 29 May with over 600 students and a digital showcase the same day.

WHAT IS UNCONFIRMED

• A GSA breach: No school statement has said attackers entered GSA systems, and the UK review of Canvas found no lateral movement into campus networks.
• A live Canvas outage: Instructure had already announced its deal on 11 May, so a fresh Canvas blackout does not explain the late May mail failure.
• A ransom at Garnethill: Nothing on the record shows GSA paid anyone, or was asked to.

In 2014 the school at least named the nightmare. Muriel Gray, then chair of the board, called the Mackintosh fire their “absolute worst nightmare” as students watched the studios go. In 2026 the nightmare was a login prompt. The statement shrank to match.

The work went on the wall. The mail came back. The date on the outage still sits on 23 May, twelve years after the first fire, and the art school has not said what broke.