Update 5/7/2026 4:11 p.m.: Sac State Information, Resources & Technology sent a message from the chancellor’s office out to Sac State emails. They said that there is no known time frame for when the problem will be solved, or when Canvas will be functioning again.

On Thursday, May 7, students worldwide received a message from the hacker group ShinyHunters when they logged into Canvas. The group claims to have stolen more than 3.65TB of student data from over 9,000 schools, including personal identifying information from over 275 million users.

The hacker group said that if Instructure, the company that owns and operates Canvas, does not respond to their ransom demands by Tuesday, May 12 all the data will be leaked publicly.

“Instead of contacting us to resolve it they ignored us and did some ‘security patches.’” ShinyHunters wrote in the ransom message. “If any schools in the affected list are interested in preventing the release of their data, please consult with a cyber advisory firm and contact us privately at TOX to negotiate a settlement.”

The ransom message provided a link to affected schools, including Sacramento State. Six CSU campuses were listed: Humboldt, Long Beach, East Bay, Dominguez Hills, Bakersfield and Channel Island. CSU resources were also affected, including CSU Online, Connect, Global Learn, the Shiley Haynes Institute for Palliative Care and the Office of the Chancellor itself.

“We are working diligently to gather more details to better understand the scope and impact of this incident. Protecting the security and privacy of our students and employees is a top priority,” wrote the CSU Chancellor’s Office in a statement regarding the first hack.

The Chancellor’s Office issued an update on May 7 stating that Canvas is down across all CSU campuses and they are working to fix the issue.

RELATED: META invests in Sacramento State’s Capital Campus project, sparking community questions

Carter Chitiva, a third year journalism major, said that he is worried about the breach. He said that himself and his classmates noticed the breach in the middle of their data science class and were all shocked by the message.

“[I’m] pretty goddamn nervous as, you know, finals are just around the corner. And now I can’t even access anything,” Chitiva said. “According to the hackers, they got everything: our personal emails, our passwords, IDs, any financial information that we had on our accounts – they have everything.”

The message from ShinyHunters issuing instructions to comply with demands that met students signing into Canvas Thursday, May 7, 2026. The group obtained personal information from 9,000 schools from over 275 million users, including students at Sacramento State. (Screenshot courtesy of u/crunchytee on r/CSUS reddit)

As of publication, both students and instructors are unable to access Canvas through its website or mobile app. Students are advised to email their professors and stay tuned for any updates or messages about classwork. As of 3 p.m. on Thursday, the Canvas website states it is down for maintenance.

Users should not input any personal information, log-in or change passwords into the Canvas system right now.

Sac State and Sac State’s Information, Resources & Technology Office were unable to respond by press time.

This story is ongoing and will be updated as more information becomes available.

Additional Reporting by Chris D. Johnson and Madison Lopez.