Canvas outage wreaks havoc for students during college finals

Educational institutions across the United States are gradually recovering from a significant cyberattack that crippled Canvas, a widely used online learning management system. The disruption, occurring during the critical finals period for many colleges, left students and faculty without access to essential academic resources including exams, course materials, lecture videos, and grade records.

By Thursday evening, Instructure, Canvas’s parent company, announced the platform had been restored for most users, though some institutions continue to restrict access as they evaluate potential security risks.

Cybersecurity firm Emsisoft confirmed that hacking group ShinyHunters claimed responsibility for the breach. The group, which previously appeared on a site listing its targets, was no longer displaying Instructure and Canvas on that list as of Friday.

Canvas serves as the digital backbone for thousands of schools and universities, functioning as a comprehensive educational hub. The platform manages virtually all aspects of modern instruction, from hosting digital lectures and course materials to facilitating classroom discussions, administering exams, and enabling communication between students and instructors. For many courses, Canvas also serves as the primary portal for submitting final projects and papers under strict deadlines.

According to cybersecurity expert Luke Connolly, ShinyHunters consists of teenage and young adult hackers operating primarily from the United States and United Kingdom. The group has been linked to several high-profile cyberattacks, including one targeting Ticketmaster. ShinyHunters describes itself as “rooting your systems since ’19,” referring to its practice of accessing a computer system’s deepest layer.

Earlier in the week, the group threatened to leak data from nearly 9,000 schools affecting approximately 275 million individuals if ransom demands weren’t met by May 6. The hackers later extended this deadline, suggesting some institutions had entered negotiations. The group has since declined to comment further on the incident.

Educational institutions have become increasingly attractive targets for cybercriminals due to the vast amounts of personally identifiable information they store on students, faculty, and staff. Recent years have seen attacks on individual districts like Minneapolis Public Schools and Los Angeles Unified School District, as well as vendor platforms such as Canvas and PowerSchool that have become integral to modern educational operations.

The service disruption’s impact on academic schedules has been substantial. The University of Massachusetts at Dartmouth postponed exams scheduled for Friday and Saturday to ensure students could access course materials that were unavailable during the outage. Similarly, the University of Illinois rescheduled all weekend examinations for all classes, regardless of whether they utilized Canvas. Montgomery County Public Schools in Maryland continued limiting Canvas access on Friday “while we work to better understand the full impact of the incident and any potential vulnerabilities.”

Regarding data security, Instructure’s chief information security officer Steve Proud stated that the breach appeared to involve student ID numbers, email addresses, names, and messages on the Canvas platform. The company has not found evidence that passwords, birth dates, government identification, or financial information were compromised.

Despite Canvas’s return to operation, cybersecurity experts urge affected students and educators to remain vigilant. There’s concern that additional malicious actors might exploit the situation through phishing attacks, potentially impersonating school districts to obtain sensitive information or credentials.

“Be very suspicious of any inbound messages,” advises Cliff Steinhauer, director of information security and engagement at the National Cybersecurity Alliance, particularly those requesting urgent action.

Security experts emphasize that this incident highlights the importance of good “cyber hygiene” practices, including creating strong passwords, enabling multifactor authentication, and monitoring accounts for suspicious activity. The Federal Trade Commission notes that major credit bureaus offer free credit freezes and fraud alerts to help protect consumers from identity theft following such breaches.

The Canvas incident represents the latest in a troubling trend of cyberattacks targeting educational infrastructure, underscoring the growing security challenges faced by institutions increasingly dependent on digital platforms for their core academic functions.