Canvas Hacked as Cyberattack Disrupts Exams at Universities and Schools Across the US

A cyberattack targeting the education platform Canvas disrupted access for students and teachers across the United States on Thursday, forcing universities and school districts to improvise during one of the busiest periods of the academic year.

The outage affected institutions ranging from large public school systems to universities including Columbia University, Princeton University, Harvard University and Georgetown University, many of which alerted students after a ransom note appeared on their Canvas homepages.

Canvas, operated by [Instructure](https://www.instructure.com?utm_source=chatgpt.com), is used by more than 30 million active users globally and serves over 8,000 institutions, according to the company’s website. For many schools, the platform functions as the main hub for assignments, lecture materials, grading and communication between faculty and students.

Students attempting to log in around midday Thursday encountered a message attributed to the hacking group ShinyHunters, which claimed responsibility for breaching the company and demanded payment to prevent the release of stolen data.

The disruption came at a particularly difficult moment for campuses already deep into final examinations and end-of-semester deadlines.

At the University of Pennsylvania, junior Anish Garimidi said he was abruptly logged out while studying for exams. Professors, he said, began distributing course materials through alternative channels as students tried to adjust.

“The biggest cause of fear and anxiety in me is that I was deprived of significant resources to study and do the best,” Garimidi told CNN.

Schools and districts in California, Florida, Georgia, Oklahoma, Oregon, Nevada, North Carolina, Tennessee, Utah, Virginia and Wisconsin also reported disruptions linked to the outage.

The incident follows an earlier cybersecurity breach disclosed by Instructure on May 1. At that time, the company said it had experienced a cyber incident involving a “criminal threat actor.” Instructure said the breach had been contained within a day, though usernames, email addresses, student identification numbers and communications from some institutions may have been exposed.

In Thursday’s ransom message, the attackers claimed the company had failed to properly address the earlier intrusion, accusing it of relying only on “security patches” after the previous breach.

During the outage, Instructure said it had placed Canvas into maintenance mode while investigating the incident. Late Thursday night, the company announced the platform had been restored “for most users.”

The group behind the attack, ShinyHunters, has previously been linked by cybersecurity researchers and US authorities to several high-profile data theft operations. The name surfaced prominently in 2024 after hackers claimed responsibility for stealing customer data connected to Ticketmaster and attempting to sell it online.

Earlier this year, cybersecurity firm Mandiant, owned by Google, reported renewed activity associated with what it described as “ShinyHunters-branded extortion operations.” Researchers said the attackers often rely on voice phishing and fake corporate login pages to gain employee credentials before targeting cloud-based systems.

Federal prosecutors in the United States have also tied the group’s name to an international hacking operation involving stolen data from more than 60 companies.

For students, however, the consequences on Thursday were immediate and practical.

Melanie Topchyan, a senior at the University of California, Riverside, said she missed a quiz because of the outage and worried about access to lecture notes ahead of an upcoming midterm.

At Massachusetts Institute of Technology, students described professors struggling to contact classes after losing access to Canvas announcements and messaging tools.

James Madison University postponed Friday exams until next week, while some instructors elsewhere extended assignment deadlines as the disruption continued into the evening.

Also Read:

World Cup Watcher Job Offers $50,000 to Watch Every Match From Times Square

The outage exposed how dependent many schools have become on a single digital platform for routine academic operations. By late Thursday, access had started returning for many users, though uncertainty remained for students still trying to recover coursework and prepare for exams before the semester closes.