Canvas Breach and Ransom Demands Disrupt U.S. Schools During Finals

What happened

Canvas, the widely used educational management platform, was taken offline Thursday following a targeted data extortion attack. The parent company, Instructure, disabled the service after the cybercrime group ShinyHunters defaced the login portal with a message threatening to leak the data of 275 million students and faculty across nearly 9,000 institutions.

What's new in this update

On Thursday, May 7, the incident escalated as hackers bypassed Instructure's initial security measures to replace the standard login page with a direct ransom note. Instructure responded by pulling the platform offline and displaying a "scheduled maintenance" message on its status page. This move has been criticized by security experts who argue the company is downplaying an active cyberattack.

Key details

The attackers claim to possess billions of private messages between students and teachers, alongside names, phone numbers, and email addresses. Instructure had previously confirmed on May 6 that identifying information like student IDs and emails had been stolen, though it found no evidence that passwords, government identifiers, or financial information were compromised. Recent reports suggest some universities may already be in negotiations with the group.

Background and context

ShinyHunters first demonstrated access to Instructure's systems on May 1. While the company initially claimed the incident was contained and that the platform was fully operational by May 6, the subsequent login page defacement proved the threat actors still held leverage. The attack comes at a critical time as many U.S. school districts and universities are currently managing end-of-year coursework and final exams.

What to watch next

Observers are watching for how many individual institutions will approach the cybercrime group directly, as the extortionists encouraged schools to settle their own ransom payments regardless of Instructure's corporate response. Additionally, the removal of Instructure from the ShinyHunters leak blog suggests that a payment may have already been made or that active negotiations are occurring.