Glasgow School of Art hacked, or was it?

Ciao bella. We hope you enjoyed your weekends. Calum took a trip to the Barras to cop us some primo vintage office furniture on Saturday. A few hours and some serious haggling later, he left laden with lamps, a coatstand and a mock Edwardian chair. Beth, meanwhile, walked the Forth Road bridge and squeezed in a Park Run. Robbie was in the rolling hills of Dumfries and Galloway, a bosky idyll of farmland and forest — surely the most underrated part of Scotland. He was there for a stag-do though, so it wasn’t all entirely wholesome. A few beers may have been had.  

Onto your briefing.  

Glasgow in Brief

💾 Confusion spread last week among Glasgow School of Art (GSA) staff and students as they were locked out of their emails. Staff even had to queue outside the art school’s Rose Street finance and IT offices to have their passwords reset in person — very old school. The Bell went down later in the week to find out what happened, as neither students nor staff had been told whether this was a cyber attack or some sort of server outage. Either way, the timing wasn’t ideal as it coincided with the start of the most important period of the GSA calendar: the degree shows.

The Bell lingered with intent for a while around GSA’s Garnethill buildings, and all eight people we spoke to had experienced the same inability to access their emails and other GSA online services. At first, nobody had any idea what had gone wrong, one interaction design student said he’d had “no access to communication” from GSA about what caused the outage. Two marketing staffers called it “an inconvenience”, but played down any further impact. 

Eventually, we found two students leaving Rose Street who confidently said this was a “big” cyber attack but not specifically targeting GSA. They said it was due to the Canvas (a learning management software used by thousands of schools and universities) hack from the start of May, where student data had been stolen. Canvas’s parent company, Instructure, negotiated for the hackers to delete the data, rather than publish the sensitive information online. It is widely believed that they paid the hackers.

The art school does use Canvas for students to access everything from reading lists to technical support. Yet the Canvas hack seems to have been resolved on 12 May. Why, then, were students and staff locked out of emails a good ten days later, right at the start of the GSA degree show week? Strangely, GSA has also been coy with The Bell. In a statement, a spokesperson said that the art school “experienced some temporary IT disruption over the weekend”, and that it has “been keeping staff and students updated as a matter of course as we resolve this”. The spokesperson added that their “IT team are currently investigating the cause of the disruption, but systems are now returning to normal”. If this was part of the Canvas hack, why not just say so? The Bell has asked GSA for further clarification. Contact calum@glasgowbell.co.uk with any leads. 

Elsewhere in art land, former British Prime Minister David Cameron was in town over the weekend to see his daughter’s degree show. Like any doting dad, he worked up an appetite and popped into Finnieston’s ultra-Instagrammable Kudos Cafe for a spot of breakfast. Eager owners Danny and Nicole were quick to make the most of the moment, posting and tagging the former PM, “RIGHT nae complaining this weekend because if it’s good enough for @dwdcameron it’s good enough for you!”

Little did they know, posting photos of polarising politicians isn’t always the best idea, and a deluge of bad reviews and “death threats” soon followed. The owners took down the post and replaced it with an explainer, apologising for any offence caused. Nothing, and no one, can be apolitical, it seems, in 2026.