Update 05\/07\/2026 at 1:52 p.m.: This article has been updated to reflect the nationwide impacts of the seizure and Instructure\u2019s status response page.<\/p>\n
Update 05\/07\/2026 at 2:14 p.m.: This article has been updated to include ShinyHunters\u2019 statement on the nationwide takedown of Instructure.<\/p>\n
UC Berkeley\u2019s learning management platform bCourses, the software that all 43,000 students use to access their class materials, has been seized by hackers. When some students attempt to log in, they are now met with a red warning label, informing users that Instructure \u2014 the company that operates Canvas \u2014 has refused to pay a ransom.<\/p>\n
In a statement to The Daily Californian, the black-hat cybercrime group ShinyHunters claims to have stolen \u201cmore than 600,000\u201d UC Berkeley student and staff records and says it will leak them unless the campus pays a ransom.<\/p>\n
The Canvas takedown appears to affect hundreds of thousands of students nationwide as universities utilizing the Instructure service have seen their learning platforms pushed offline, with the same red warning message appearing on user screens.<\/p>\n
In a statement to the Daily Cal following the nationwide seizure, ShinyHunters said, \u201cWe urge Instructure to reach out and resolve this situation with us amicably.\u201d<\/p>\n
\u201cAffected institutions also have the opportunity to reach out to us to prevent the release of the data since Instructure is being non-transparent and seemingly does not care for its customers,\u201d ShinyHunters said. \u201cAll (data) will be leaked by 12 May 2026 except the ones that pay.\u201d<\/p>\n
Instructure\u2019s software status website confirms the blackout, stating, \u201cCanvas, Canvas Beta and Canvas Test are currently unavailable.\u201d The company claims they are \u201cinvestigating\u201d the issue as of 2:41 p.m. PST.<\/p>\n
Prior to this afternoon\u2019s seizure, ShinyHunters told the Daily Cal the stolen information included \u201cstudent and staff email addresses, names, student IDs, courses enrolled, and tons of private messages.\u201d Students should be wary when attempting to log in to bCourses, as the group claims the current attack may use a different infiltration method and password entries could be stolen.<\/p>\n
Campus spokespeople declined to comment on the breach prior to the seizure, and the UC Office of the President, or UCOP, spokesperson Stett Holbrook had said in a statement, \u201cWe believe that the Canvas platforms for several UC campuses may have been impacted by the recent breach by threat actors.\u201d<\/p>\n
\u201cAlthough Instructure reports that Canvas is fully operational and is not seeing any ongoing unauthorized activity, we continue to monitor the situation and are evaluating next steps,\u201d Holbrook said. \u201cUC will provide updates on UCnet as more information becomes available.\u201d<\/p>\n
The group claims to have obtained these records from a massive, nationwide breach of the company Instructure and its student learning platform, Canvas, and threatens to publish the personal information of users from more than 7,000 schools and universities.<\/p>\n
The Daily Cal has contacted the group and obtained a list of allegedly affected institutions via the ShinyHunters\u2019 dark web breach site. The list includes multiple UC campuses, including UC Berkeley, UCLA, UC Davis, UC Riverside, UC San Diego, UC Irvine and the UC-operated online course provider for high school students, UC Scout.<\/p>\n
The Daily Cal was unable to independently verify the reported number of stolen UC Berkeley student and staff records.<\/p>\n
ShinyHunters says a ransom payment by Instructure can prevent the release of personally identifiable information of more than 275 million students, teachers and staff. While the ransom deadline was set to expire Thursday, the group has pushed it to May 12 because some institutions have engaged in ransom negotiations, according to an update on its dark web site.<\/p>\n
While the campus Information Security Office, or ISO, and UCOP have released statements in the past week reporting a nationwide Canvas breach, neither has publicly confirmed that UC campuses were directly affected.<\/p>\n
\u201cOur demand was not even as high as you might think it is,\u201d ShinyHunters wrote on its site. \u201c(Instructure) seemingly does not care about all the students affected and the institutions impacted by this data breach.\u201d<\/p>\n
According to 2024 data, Canvas is used by 41% of higher education institutions in North America. All nine UC undergraduate campuses use Canvas, but notably, ShinyHunters\u2019 list does not include UC Santa Cruz, UC Santa Barbara or UC Merced.<\/p>\n
According to the ISO, Instructure notified the campus of the nationwide \u201ccybersecurity incident\u201d May 1, and the leaked information may have included \u201cnames, email addresses, student ID numbers, and messages exchanged in Canvas\/bCourses.\u201d<\/p>\n
However, the ISO claims there is \u201cno evidence\u201d that the breach involved passwords, birthdates, government identification or financial information.<\/p>\n
On Monday, some Turnitin services on UC Berkeley bCourses, the campus Canvas software, were impacted by an unplanned API key rotation during Instructure\u2019s response to the breach, according to the ISO in a statement on its website.<\/p>\n
ShinyHunters is a well-known hacker group responsible for numerous ransom attacks since 2020 and has previously targeted universities. In late 2025, the group stole alumni information from Harvard University, Princeton University and the University of Pennsylvania.<\/p>\n
These attacks involve a \u201cpay or leak\u201d strategy, in which victims must hand over sums, often in the hundreds of thousands of dollars, usually in cryptocurrency, to prevent attackers from dumping the stolen information on the internet. According to TechCrunch, Harvard University and the University of Pennsylvania failed to pay in 2025, resulting in the leak of more than 1 million alumni and development records.<\/p>\n
ShinyHunters declined to disclose how much money it is demanding from UC Berkeley or Instructure in order to prevent the release of stolen data.<\/p>\n
\u201cMake the right decision, don\u2019t be the next headline,\u201d ShinyHunters wrote on its site.<\/p>\n
This is a developing story. Check back for updates.<\/p>\n","protected":false},"excerpt":{"rendered":"Update 05\/07\/2026 at 1:52 p.m.: This article has been updated to reflect the nationwide impacts of the seizure…\n","protected":false},"author":2,"featured_media":304879,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[34],"tags":[15160,12947,32729,128446,143,145,144,97151,128445,77569,128448,149,8229,35412,7346,49210,5729,28424,40229,128447,1092,68986],"class_list":["post-304924","post","type-post","status-publish","format-standard","has-post-thumbnail","category-oakland","tag-bcourses","tag-canvas","tag-harvard-university","tag-instructure","tag-oakland","tag-oakland-headlines","tag-oakland-news","tag-princeton-university","tag-shinyhunters","tag-techcrunch","tag-turnitin","tag-uc-berkeley","tag-uc-davis","tag-uc-irvine","tag-uc-merced","tag-uc-riverside","tag-uc-san-diego","tag-uc-santa-barbara","tag-uc-santa-cruz","tag-uc-scout","tag-ucla","tag-university-of-pennsylvania"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/us-ca\/wp-json\/wp\/v2\/posts\/304924","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/us-ca\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/us-ca\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/us-ca\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/us-ca\/wp-json\/wp\/v2\/comments?post=304924"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/us-ca\/wp-json\/wp\/v2\/posts\/304924\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/us-ca\/wp-json\/wp\/v2\/media\/304879"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/us-ca\/wp-json\/wp\/v2\/media?parent=304924"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/us-ca\/wp-json\/wp\/v2\/categories?post=304924"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/us-ca\/wp-json\/wp\/v2\/tags?post=304924"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}