The note read: “Shiny Hunters has breached Instructure (again).”
It threatened to release stolen data unless a ransom was paid in bitcoin by Canvas or affected universities.
“My knee‑jerk reaction was that I’d been hacked myself, because that’s what it looked like,” Palmer said. “But then I actually read the ransom note and saw it was Canvas that had been hacked.”
Aubrey said their professor and dozens of students received the same message, and there was confusion in the exam room about whether their work had been saved.
Mississippi State University later announced some exams would be postponed to allow students to recover any lost work.
Shiny Hunters is known for hacking organisations, stealing data and then publicly pressuring victims to pay ransoms in bitcoin.
The group has been linked to other breaches, including attacks on Jaguar Land Rover and Gucci. The criminals are English‑speaking and believed to be young.
In Telegram messages exchanged with the BBC, Shiny Hunters said it had hacked Canvas twice before last Thursday’s attack.
Instructure disclosed a breach in September 2025 in a post on its blog.
Shiny Hunters has also claimed it breached the company again in April 2026, ahead of the 29 April attack.
When asked how it felt about the stress and disruption caused to students like Aubrey Palmer, the group said: “We have no comment on that.”
It would not say how much it had been paid by Instructure.