Nationwide Canvas Outage Disrupts Finals as ShinyHunters Demands Ransom

On Thursday, May 7 2026, the learning-management system Canvas displayed a ransom note from the cyber-extortion group ShinyHunters. The message warned that the group had “breached Instructure (again)” and gave schools until May 12 to negotiate a settlement or face public release of stolen data. Within minutes, Canvas entered “maintenance mode” and became inaccessible to students and faculty at hundreds of institutions, many of which were in the middle of final-exam week.

Nationwide Canvas outage affects Emory community during finals week

This incident follows a May 1 breach of Instructure, the parent company of Canvas, in which names, email addresses and student-ID numbers were exposed. ShinyHunters has previously targeted education-technology vendors such as Infinite Campus, McGraw-Hill and Vimeo. The May 7 attack marks the second major Canvas disruption within a single month.

Nationwide Canvas outage affects Emory community during finals week

Instructure reports more than 30 million active users worldwide and over 8,000 institutional customers. Independent trackers cite 9,000 schools—spanning Ivy League universities, public K-12 districts in California, Florida, Georgia, Oklahoma, Oregon, Nevada, North Carolina, Tennessee, Utah, Virginia and Wisconsin—and roughly 275 million individuals as potentially affected. The compromised data set is estimated at 3.65 TB, comprising names, email addresses, student-ID numbers and private Canvas messages; no passwords, Social Security numbers or financial data were confirmed as breached.

CNN

Students reported loss of access to grades, lecture recordings, quizzes and submission portals. At the University of Pennsylvania, junior Anish Garimidi described “significant resources…deprived” during finals. Georgetown sophomore Minhal Nazeer noted that the outage granted her an unexpected deadline extension, while MIT junior Allison Park highlighted the platform’s role as the primary communication channel between faculty and students. Universities such as James Madison, Penn State and the University of Memphis postponed exams or extended grading deadlines to mitigate the disruption.

CNN

Instructure’s status page confirmed an ongoing investigation, reiterating that only personally identifiable information (names, emails, IDs, messages) was exposed and that passwords remained secure. Penn State urged caution, cancelled two Pollock Testing Center exams and promised grading adjustments. UW-Madison’s provost John Zumbrunnen extended grading deadlines to May 14 and warned students not to click any links. Emory’s Office of Information Technology announced coordination with Instructure and pledged regular updates. Several school districts, including Anne Arundel County Public Schools, temporarily disabled Canvas logins.

Fox News (website)

Students expressed heightened privacy concerns; OU senior André-Denis Wright emphasized the “global issue” and the need for protective measures. Texas State’s chief information security officer Dan Owen warned that the university would not consider paying a ransom, citing policy and the uncertain completeness of the attacker’s list. Faculty across campuses criticized the heavy reliance on a single vendor for core academic functions, calling for diversified digital infrastructures.

Data breach shuts down Canvas, stalls finals

Sources differ on the total number of affected institutions—Instructure cites 8,000 customers, while ShinyHunters claims 9,000 schools. The extent of compromised data remains disputed; some statements assert no financial or biometric data were taken, whereas others note the lack of definitive verification. Instructure has not disclosed whether it will negotiate with the attackers.

Fox News (website)

• “ShinyHunters has breached Instructure (again),” — University of Washington student (May 7)

CNN

• “The biggest cause of fear and anxiety in me is that I was deprived of significant resources to study and do the best,” — Anish Garimidi, junior, University of Pennsylvania

CNN

• “I was already in a good spot to finish all my papers, so I’m not too bothered by it, but I do see it is helping me a little, because I have gotten some extension.” — Minhal Nazeer, sophomore, Georgetown University

CNN

• “One thing that struck me was how dependent the professors and teaching staff were on it to even just communicate with students,” — Allison Park, junior, MIT

CNN

• “We are actively monitoring the ongoing investigation and will continue to keep our community informed as additional information becomes available.” — André-Denis Wright, Provost, University of Oklahoma

OU, Norman Public Schools part of worldwide Canvas hack by extortion group

Instructure aims to restore full Canvas functionality “soon,” though no precise timeline has been provided. Universities have advised faculty to offer alternative submission methods and to remain vigilant for phishing attempts. The May 12 deadline looms as the final window for any potential ransom negotiations, while regulators and privacy advocates monitor the breach’s compliance implications under FERPA.

Data breach shuts down Canvas, stalls finals