The hacker group ShinyHunters claimed responsibility for the cyberattack against Instructure, the Salt Lake City-based company behind Canvas.
Nearly 9,000 schools worldwide are affected, the hackers said, adding that the data breach includes the private messages and other “personally identifiable information” of 275 million individuals.
University leaders were first made aware of a breach involving Canvas in the first few days of May, according to the California State University system, but the platform remained operational until Thursday.
Cecil H Green Library at Stanford University in Palo Alto on December 10, 2025. (Tâm Vũ/KQED)
CSU officials said Tuesday that the Instructure CEO and chief security officer reported that “there is no evidence that passwords, Social Security numbers, financial information, or other highly sensitive data were compromised.”
On Thursday, the CSU said Canvas was down across all of its campuses and at the central chancellor’s office.
“This situation is fluid, and we are working with Instructure to determine the full scope of impact,” the CSU’s Canvas status page said.
The University of California system directed all of its campuses to take Canvas offline, saying in an update Thursday that “Canvas access will not be restored until we are confident the system is secure.”
Some students trying to access Canvas earlier reportedly saw a screen from ShinyHunters saying that Instructure had failed to pay their ransom. The hackers gave Instructure and any affected schools until May 12 to negotiate a settlement to prevent the data from being released.