A nationwide cyberattack on Canvas, a learning management system used by thousands of schools and universities in the United States, caused widespread disruption on Thursday as students prepared for final exams. The outage prompted panic among students who lost access to course materials, lecture slides, and study resources hosted on the platform.
Institutions including the University of Texas at San Antonio, Virginia Tech, and the University of New Mexico notified students of the incident, with some postponing finals scheduled for Friday. The director of IT at the University of Iowa’s College of Public Health described it as a “national-level cyber-security incident.” The University of Florida advised students to remain vigilant against phishing messages that might appear to originate from Canvas.
The hacking group ShinyHunters claimed responsibility, according to Luke Connolly, a threat analyst at cybersecurity firm Emsisoft. Connolly reported that the group posted online that nearly 9,000 schools worldwide were affected, with billions of private messages and records accessed. Screenshots showed the group began threatening to leak the data on Sunday, with deadlines of May 7 and May 12, suggesting possible extortion negotiations.
Canvas, owned by Instructure, is used to manage grades, course notes, assignments, and lecture videos. Instructure did not immediately respond to requests for comment. Connolly noted the attack resembled a breach at PowerSchool earlier this year. He described ShinyHunters as a loose affiliation of teenagers and young adults based in the US and UK, also tied to attacks on Live Nation’s Ticketmaster.
Damon Linker, a senior lecturer at the University of Pennsylvania, said on social media that students and faculty were “dead in the water” without Canvas access ahead of final exams. Schools such as Harvard and Johns Hopkins reported outages, while public school districts like Spokane, Washington, assured parents that no sensitive data appeared to be compromised. The incident underscores the vulnerability of educational institutions to cyberattacks.
