QuickLaunch outages hit universities first day back on campus

The start of the new school year is not off to a smooth start for higher education customers of identity management and authentication platform QuickLaunch.

Early Monday morning, many students found themselves unable to log in to their university email or learning management system, making it impossible to access important information on scheduling and enrollment ahead of their first day of class.

QuickLaunch’s single sign-on platform, which is designed to make institutional authentication quick and easy, continued to experience intermittent outages throughout Monday and most of Tuesday, leaving institutions scrambling to implement alternative sign-in procedures and restore access to essential services.

QuickLaunch did not respond to requests for comment, but published a service update on Monday stating it was unsure of the root cause of the issue. On Tuesday, the company said it was the victim of a distributed denial-of-service attack, with hackers flooding the system with password reset requests, impacting “tightly coupled identity infrastructure” and causing the login process to become “sluggish to the extent of being unavailable most times.”

An update published by QuickLaunch at 3.45 p.m. Tuesday stated that service had been restored through an emergency workaround.

The identity and motive of the attackers is unknown, but the timing of the attack, right as students return to campus, is commonly chosen to maximize disruption. The University of Houston-Clear Lake, was one of dozens of institutions affected by the QuickLaunch outages.

“Yesterday morning, our first class day and the first day back on campus for all classes after the pandemic, we started receiving reports that students and faculty could not log into Blackboard and Office 365,” LeeBrian Gaskins, chief information officer and senior associate vice president for IT at the university, wrote in an email to EdScoop.

IT staff at Houston-Clear Lake called QuickLaunch for a status update early on Monday and were told the system was experiencing problems but should be back within the hour.

“That resolution did not happen; the system had issues until around 4am this morning. At about 4am we noticed the system was responsive but quickly deteriorated around 8am this morning again,” Gaskins said.

The University of Houston-Clear Lake restored access to some university applications, but Gaskins warned that exiting the single sign-on system carries a security risk.

“Various applications have different levels of security,” he explained. “With SSO, we disabled legacy authentication on several applications. Now that legacy authentication is back for some applications; they are inherently less secure.”

Denial-of-service attacks are common and do not represent a security breach per se, but are often seen as a red flag by security professionals.

“I do not have direct concerns over a security breach at QuickLaunch,” Gaskins said. “However, the events’ timeline and communication leave me questioning whether this was a security incident or an upgrade gone wrong.”