During final exams, the learning management system ‘Canvas’ became temporarily unavailable at a school after a criminal group, ShinyHunters, launched a blackmail attack threatening to leak data from approximately 9,000 institutions.
https://gigazine.net/gsc_news/en/20260511-canvas-shinyhunters/
Publish Date: 2026-05-11 01:16:00
Source Domain: gigazine.net
May 11, 2026 14:10:00
The learning management system ‘Canvas,’ used by schools and universities for distributing course materials, submitting assignments, managing grades, and facilitating communication between teachers and students, was temporarily unavailable at schools and universities across the United States due to a data extortion attack by the cybercrime group ‘ShinyHunters.’
Instructure Status – Confirmed Security Incident
https://status.instructure.com/incidents/9wm4knj2r64z
Canvas Breach Disrupts Schools & Colleges Nationwide – Krebs on Security
https://krebsonsecurity.com/2026/05/canvas-breach-disrupts-schools-colleges-nationwide/
Canvas login portals hacked in mass ShinyHunters extortion campaign
https://www.bleepingcomputer.com/news/security/canvas-login-portals-hacked-in-mass-shinyhunters-extortion-campaign/
Canvas outage wreaks havoc for students during college finals | AP News
https://apnews.com/article/canvas-outage-college-students-exams-grades-209a51692f043a959459dbe37fb34e4b
Canvas is a widely used service for university lecture pages and online learning environments in elementary, middle, and high schools. Students read course materials, submit assignments, and participate in tests and discussions on Canvas. Instructors grade and communicate through Canvas, so if Canvas goes down, it’s not just a ‘website outage’ but could potentially bring the entire class to a halt.
Instructure, the company that operates Canvas, detected the unauthorized access on April 29, 2026, and began an investigation. As of May 2, Instructure stated that the information that may have been stolen included identification information such as names, email addresses, and student ID numbers, as well as messages between users. However, they stated that they had not found any evidence that more sensitive information, such as passwords, dates of birth, government-issued IDs, or financial information, was included.
Instructure initially stated…
