MAY 8, 2026
Cyberattack on Canvas learning platform disrupts finals season for millions of students across the US
A cyberattack on Canvas, the cloud-based learning platform operated by parent company Instructure, knocked the service offline Thursday, affecting more than 8,000 institutions and 30 million active users globally during final exam season. The hacking group ShinyHunters claimed responsibility for the breach, demanding ransom payments to prevent data leaks. Instructure announced Friday morning that Canvas was "fully back online and available for use," though some schools continued to restrict access out of caution.
Canvas went offline Thursday after hacking group ShinyHunters posted ransom notes on the homepages of multiple universities' Canvas sites, including Columbia, Princeton, Harvard, and Georgetown. The group stated it had accessed data from millions of users — including students, teachers, and staff — and gave schools until May 12 to negotiate a settlement, according to CNN.
This was the second breach ShinyHunters attributed to Instructure within the month. On May 1, Instructure disclosed a prior cybersecurity incident and said the breach had been contained the following day, with some usernames, email addresses, student ID numbers, and communications potentially exposed. ShinyHunters stated in a note shared May 3 on Ransomware.live that it had breached 275 million individuals' data and had access to "several billions of private messages," according to CNN. The group cited a May 6 deadline for Instructure to respond; when that deadline passed, ShinyHunters issued a new note targeting the platform directly.
Instructure said Friday that an "unauthorized actor" had exploited a vulnerability tied to the company's Free-For-Teacher accounts. The company said it made "the difficult decision to temporarily shut down" those accounts in order to restore Canvas service. By late Thursday, the platform was available again to most users, and ShinyHunters' listing of Canvas as a target had been removed from the group's public site, the Associated Press reported.