Canvas Cyberattack Disrupts Global Education Platform During Finals

On May 7 2026 the Canvas learning-management system, run by Instructure, was taken offline after the hacking group ShinyHunters claimed to have breached the platform. The group posted a ransom note demanding payment by May 12 or threatening to release data from roughly 275 million users at nearly 9,000 schools. The outage coincided with final-exam week, disrupting coursework for millions.

Desert Sun

Instructure reported an initial “cybersecurity incident” on April 29, contained by May 2. ShinyHunters, linked to the 2024 Ticketmaster breach, posted a ransom note on May 3 with a May 6 deadline, then a final May 12 deadline. Canvas entered maintenance mode on May 7; most users were restored by May 8, while Beta and Test services stayed offline.

WMUR9

Canvas supports about 30 million active users. ShinyHunters claims access to data of 275 million individuals. Over 9,000 institutions—including Harvard, MIT, Penn State, and K-12 districts in NC, TX, MD—were affected. Instructure found no passwords or financial data compromised. The breach also exposed private messages exchanged within Canvas, which experts say can be leveraged for targeted scams.

Canvas Hack Puts Student Data at Risk: What to Do if Your Info Was Exposed

Instructure’s Brian Watkins said the company “temporarily shut down Free-For-Teacher accounts” to contain the breach and later confirmed Canvas was “fully back online.” The FBI warned against paying ransom. Prince William County and Wake County urged families to change passwords and enable two-factor authentication. Instructure pledged to work with law-enforcement and third-party forensic experts to assess the incident.

CNN

Analysts warned the breach shows “concentration risk” in ed-tech. Rakesh Shah noted contextual data fuels phishing. Peter Tran called paying extortion “a fine dance … not foolproof,” urging better disaster-recovery planning.

CNN

Damon Linker of Penn said the outage “deprived many of the resources they need to study.” UMass Lowell postponed exams. Teachers used email, Google Docs, and paper submissions while Canvas remained unavailable.

KTVT - Dallas - Fort Worth News

Instructure says no passwords or financial data were taken, but the 275 million user claim lacks independent verification, and no evidence of data taken on May 7 remains.

Canvas Hack Puts Student Data at Risk: What to Do if Your Info Was Exposed

• “ShinyHunters has breached Instructure (again).” — Luke Connolly, threat analyst, Emsisoft

KCPQ - Fox 13 - Seattle

• “We regret the inconvenience and concern this may have caused.” — Brian Watkins, Instructure spokesperson

NPR

• “The problem with using a platform like Canvas is that most [students] are not going to have the readings available printed out or on their laptops,” — Damon Linker, senior lecturer, University of Pennsylvania

NPR

• “It's a fine dance between saying, okay, in good faith, we're going to pay it.” — Peter Tran, cybersecurity expert

WBTS - NBC 10 - Boston

• “deprived of significant resources to study and do the best.” — Anish Garimidi, University of Pennsylvania junior

Newsweek

Instructure will audit the Free-For-Teacher service and tighten authentication. Schools are advised to monitor phishing, consider credit-freeze for families, and prepare for the May 12 deadline as law-enforcement continues its investigation.

Canvas Hack Puts Student Data at Risk: What to Do if Your Info Was Exposed