---
title: "Canvas Outage Hits Universities After ShinyHunters Breach"
date: 2026-05-08
author: "Sofia Ramirez"
featured_image: "https://sqmagazine.co.uk/wp-content/uploads/2026/05/canvas-outage-hits-universities-after-shinyhunters-breach.jpg"
categories:
  - name: "Cybersecurity"
    url: "/cybersecurity.md"
tags:
  - name: "News"
    url: "/tag/news.md"
---

# Canvas Outage Hits Universities After ShinyHunters Breach

Canvas users across major universities and schools lost access to coursework, assignments, and exam materials after a cyberattack linked to the hacking group ShinyHunters disrupted Instructure’s learning platform.

## Quick Summary – TLDR:

- Canvas suffered a widespread outage after hackers linked to ShinyHunters targeted parent company Instructure.
- Universities including Harvard, MIT, Rutgers, Princeton, and Columbia reported disruptions during final exam season.
- Hackers threatened to leak stolen data on May 12 unless negotiations begin with affected institutions.
- Millions of students and teachers temporarily lost access to coursework, messages, lecture recordings, and assignments.

## What Happened?

A major outage affecting **Canvas**, one of the world’s most widely used online learning platforms, disrupted thousands of universities and K-12 schools across the United States and beyond. The outage came after cybercriminal group **ShinyHunters** claimed responsibility for breaching **Instructure**, the company behind Canvas.

Users attempting to access Canvas on Thursday were redirected to a ransom style message from the hackers before the platform was later taken offline for maintenance.

> 🚨 BREAKING: Instructure, the company behind Canvas – the LMS tool used by almost every university in the United States, has been breached by popular threat actor ShinyHunters.   
>   
> List of breached schools:  
> http://91.215.85.103/pay\_or\_leak/instructure\_affected\_schools\_list.txt [pic.twitter.com/bm5Pq2cjJk](https://t.co/bm5Pq2cjJk)
> 
> — Titan Security (@TitanSecAI) [May 7, 2026](https://twitter.com/TitanSecAI/status/2052488279040352748?ref_src=twsrc%5Etfw)

 ## Hackers Target Instructure and Canvas

The disruption began escalating after students and faculty members reported unusual messages appearing on Canvas login pages. The message, allegedly posted by **ShinyHunters**, [claimed the group had breached Instructure “**again**”](https://sqmagazine.co.uk/instructure-canvas-shinyhunters-data-leak/) and warned schools that stolen data would be leaked publicly if negotiations were not opened before May 12.

The hackers accused Instructure of ignoring previous outreach attempts and relying only on small security patches after an earlier breach disclosed on May 1.

According to the messages seen by users, the group claimed to have [stolen data](https://sqmagazine.co.uk/data-breach-statistics/) tied to more than **275 million people across nearly 9,000 schools**. The hackers also threatened to leak “**several billions of private messages among students and teachers.**”

Instructure has not confirmed the scale of the claims made by the attackers.

## Universities Across the US Report Disruptions

Several universities publicly acknowledged problems tied to the outage, including **Harvard University**, **MIT**, **Rutgers**, **Georgetown**, **Princeton**, **Columbia**, the **University of Michigan**, the **University of Washington**, and the **University of Pennsylvania**.

At Harvard, students reported that Canvas remained accessible until Thursday afternoon before suddenly redirecting users to the hacker message around **3:30 p.m**. By later in the evening, the platform displayed a maintenance notice instead.

Harvard University Information Technology spokesperson Tim Bailey said the university was “**aware that the Canvas platform is currently unavailable due to a cyber incident**.”

Bailey added that the university was actively investigating the situation and monitoring updates from Instructure.

Multiple school districts and colleges also warned students and faculty about temporary disruptions to assignments, lecture recordings, course websites, and professor announcements.

## Final Exams Thrown Into Chaos

The timing of the outage created major problems for schools already deep into final exam season.

Many instructors rely heavily on Canvas for communication, assignment submissions, quizzes, and study materials. Students across social media complained they could not access lecture recordings, revision guides, project files, or even messages from professors during critical preparation periods.

Some institutions temporarily switched to email and alternative communication tools while others delayed assignments and exams entirely.

**James Madison University** reportedly revised parts of its exam schedule and postponed several tests until the following week because of the disruption.

## What Data Was Exposed?

Instructure first disclosed a [cybersecurity incident](https://sqmagazine.co.uk/cybersecurity-attacks-statistics/) on May 1, saying attackers had accessed certain user information. According to the company, compromised data included:

- **Names**
- **Email addresses**
- **Student ID numbers**
- **Canvas messages exchanged between users**

The company said there was no evidence that passwords, dates of birth, financial records, or government identifiers were exposed.

Steve Proud, Instructure’s chief information security officer, previously said the company brought in forensic experts and security teams to contain the breach.

Instructure stated earlier this week that the incident had been contained and that “**Canvas is fully operational.**” However, Thursday’s renewed disruptions and login page defacements raised questions about whether attackers retained access or exploited additional vulnerabilities.

By Thursday evening, Instructure said Canvas had been restored for most users, though some services remained under maintenance.

## ShinyHunters Expands Attacks on Education Sector

ShinyHunters has become one of the most recognizable cybercriminal groups in recent years, previously linked to attacks involving **Ticketmaster**, **[Microsoft](https://sqmagazine.co.uk/microsoft-statistics/)**, and **AT&T**.

The group has increasingly targeted the education sector in recent months, including attacks involving **Infinite Campus** and textbook publisher **McGraw Hill**.

Security experts warn that education platforms remain attractive targets because they store massive amounts of student data, private communications, and institutional records.

## SQ Magazine Takeaway

I think this incident shows just how fragile modern education systems have become when everything depends on a single online platform. Universities now rely on services like Canvas for almost every part of academic life, from exams to communication. When these systems fail during a cyberattack, millions of students are left stranded instantly.

What makes this even more concerning is the possibility that attackers may still have access even after companies claim incidents are contained. Schools and education companies are clearly becoming major targets for cybercriminals, and this outage may push universities to rethink how much they depend on centralized learning platforms.