Canvas, the online education management platform used by thousands of educational institutions around the world, is back online for some California universities and schools on Friday, May 8, after a major data breach \u2014 with conditions.<\/p>\n
The platform was taken offline across California, and the nation, on Thursday, May 7, amid a cyberattack involving a \u201ccriminal threat actor,\u201d according to Instructure, the company that manages Canvas.<\/p>\n
Colleges, universities, and even some K-12 school districts were left scrambling on Thursday to secure their Canvas platforms, inform students and faculty about the impacts, and figure out a solution as many students are in the midst of completing final assignments and preparing for final exams.<\/p>\n
Instructure, in an incident report log posted on May 6, said that some information potentially at risk on account of the security breach included identifying information such as names, email addresses, student ID numbers and messages between Canvas users.<\/p>\n
Canvas is used to manage digital learning across educational levels, and is home to course materials, assignments, grades, and other vital learning materials.<\/p>\n
\u201cAt this time, we have found no evidence that passwords, dates of birth, government identifiers or financial information were involved. If that changes, we will notify any impacted institutions,\u201d the Instructure log said.<\/p>\n
Some social media users posted online Thursday, May 7, reporting that their access to Canvas had been blocked \u2014 and instead, they were shown messages from the apparent perpetrator of the attack, a group that identified itself as \u201cShiny Hunters.\u201d<\/p>\n
The message claims that Shiny Hunters will release the data it obtained from affected schools on May 12, 2026, unless Instructure or any of the impacted schools \u201cconsult with a cyber advisory firm\u201d and contact Shiny Hunters \u201cprivately\u201d to \u201cnegotiate a settlement.\u201d<\/p>\n
None of the impacted colleges or universities, nor Instructure, have confirmed the identity of the perpetrator of the attack as of Friday, May 8, though a representative for the company did confirm that the attack was perpetrated by an \u201cunauthorized actor.\u201d<\/p>\n
\u201cYesterday, Instructure discovered the unauthorized actor involved in our ongoing security incident made changes to the pages that appeared when some students and teachers were logged in,\u201d Brian Watkins, the company\u2019s senior communications director, said Friday. \u201cOut of an abundance of caution, we immediately took Canvas offline to contain access and further investigate.\u201d<\/p>\n
Instructure, Watkins added, has confirmed that the \u201cunauthorized actor\u201d was able to exploit a security issue in the platform\u2019s Free-For-Teacher accounts, which allows educators to build courses, assignments, and other educational materials on the platform for free.<\/p>\n
\u201cAs a result, we have made the difficult decision to temporarily shut down our Free-For-Teacher accounts,\u201d Watkins said. \u201cThis gives us the confidence to restore access to Canvas, which is now fully back online and available for use. We regret the inconvenience and concern this may have caused.\u201d<\/p>\n
While Canvas is largely back online, according to Instructure, many California educational institutions have yet to allow their users back onto the platform as of around noon on Friday.<\/p>\n
All 116 colleges governed by California Community Colleges across the state have been impacted by the Canvas breach, a representative said previously, and the platform was taken down for all users as a result.<\/p>\n
CCC also reported that some Canvas users, on Thursday, had received emails from the hacker group.<\/p>\n
\u201cThe email claims hackers have been monitoring the user\u2019s activity on web browsers and seeks payment in Bitcoin within 48 hours to have any compromising information deleted,\u201d the CCC said on its website. \u201cThis is a scam and anyone receiving such a message should delete it immediately. Do not click on any links, open any attachments, download files, or respond.\u201d<\/p>\n
While Instructure has begun restoring access to Canvas for CCC schools, according to the group\u2019s website, the investigation and security validation process was still not complete as of Thursday evening.<\/p>\n
\u201cCanvas is currently coming back online across the California Community Colleges system,\u201d CCC\u2019s executive in residence for strategic technology initiatives Jory Hadsell said Friday. \u201cColleges are taking a careful, phased approach to restoring access to help ensure systems and user information remain secure for our students and faculty.\u201d<\/p>\n
The CCC Security Center, Hadsell added, is working with Instructure and various college technology teams to implement additional safety measures as needed as Canvas is brought back online for users.<\/p>\n
\u201cAs colleges restore access, we are also reminding our campus communities to remain alert to potential phishing or scam attempts,\u201d Hadsell added. \u201cCanvas users should be cautious of unexpected emails or messages that request personal information, prompt urgent action, or include suspicious links or attachments.\u201d<\/p>\n
The California State University system, which serves more than 470,000 students across 23 campuses statewide, was in a similar boat as of Friday afternoon.<\/p>\n
CSU officials released a statement on Friday afternoon saying that while Canvas service has been restored for its users, the university system had not yet opened access to the platform for its users but was working on doing so no later than Friday afternoon.<\/p>\n
Some individual CSU campuses, including Cal Poly Pomona, still said that Canvas was currently down and that they were working to resolve the issue as of Friday afternoon.<\/p>\n
\u201cProtecting the data and privacy of our campus community is a top priority,\u201d the CSU said in a Friday statement. \u201cThroughout this process that has impacted thousands of higher education systems globally, the California State University has worked closely with Instructure, state partners, and cybersecurity experts to ensure that our campuses can continue to use Canvas with confidence.\u201d<\/p>\n
The CSU also advised Canvas users to keep cybersecurity protocols in mind once their access to the platform is restored this afternoon.<\/p>\n
\u201cWe strongly recommend that you download and save any important or necessary documents for added security,\u201d the CSU added. \u201cWhere possible and consistent with academic integrity instructions, create any long responses in a local document you can paste in when complete.\u201d<\/p>\n
Some University of California schools, including UC San Diego, UCLA, UC Irvine, and UC Davis also appeared to still be grappling with the crisis as of Friday afternoon.<\/p>\n
\u201cNow that Instructure has advised that the incident has been contained and remediated, UC is making risk-based decisions about when to restore access to Canvas at campuses based on their operational needs,\u201d UC wrote on its website on Friday. \u201cUC will continue to work closely with its IT teams across the system and determine next steps based on updates from Instructure.\u201d<\/p>\n
Functionality has been restored to Canvas for UCLA users, according to the university, as of around 9 a.m. Friday morning, but user access to the platform is still restricted.<\/p>\n
\u201cIn alignment with UC guidance, UCLA is performing security assurance, configuration, and integrity checks before re-enabling access,\u201d UCLA said. \u201cAn announcement on platform restoration will be shared when a decision has been made.\u201d<\/p>\n
The same goes for UCI, where Canvas functionality has been restored but is still inaccessible to students.<\/p>\n
\u201cAlthough Instructure has indicated that Canvas is available for most users, at this time UC Office of the President is seeking greater assurances from the vendor on both system safety and on the integrity of the data in it,\u201d the university wrote. \u201cWe will share an update as soon as we have one, but access is unlikely to be restored until this afternoon at the earliest.\u201d<\/p>\n
Some K-12 school districts, including the Murietta Valley Unified School District, also restored Canvas access to its users as of Friday afternoon, according to a message from the district sent to students and faculty.<\/p>\n
It was unclear as of Friday around 3 p.m. whether other impacted school districts, including Long Beach Unified School District and Santa Ana Unified School District, had restored access to Canvas.<\/p>\n
For one cybersecurity expert, this global breach of Canvas is indicative of larger cybersecurity concerns for educational institutions \u2014 which are no strangers to becoming the target of hackers seeking a ransom.<\/p>\n
The Los Angeles Unified School District, for example, was the victim of a massive cyberattack in 2022,<\/a> which resulted in driver\u2019s license numbers, Social Security numbers, psychological assessment records, and other sensitive information linked to thousands of students being leaked on the dark web.<\/p>\n Cliff Steinhauer, the National Cybersecurity Alliance\u2019s director of information security and engagement, said in a Friday statement that the Canvas breach underscores why schools, universities, and colleges are often targeted by malicious hackers.<\/p>\n \u201cCybercriminals are increasingly incentivized to target large technology vendors and shared service providers because compromising a single platform can provide access to thousands of organizations at once, making it far more efficient and profitable than attacking individual schools one by one,\u201d Steinhauer said. \u201cThis incident should serve as a wake-up call for both schools and technology vendors to strengthen vendor risk management, improve incident response planning, and treat cybersecurity as a core component of educational resilience.\u201d<\/p>\n And, Steinhauer added, even though sensitive information like SSNs, driver\u2019s license numbers, or financial information wasn\u2019t compromised as a result of the Canvas breach, the data stored on the platform could still be useful to hackers.<\/p>\n \u201cEven if highly sensitive financial information was not exposed, educational records, communications, and identity data can still be valuable to cybercriminals for phishing, impersonation, and future attacks,\u201d Steinhauer said. \u201cWhen a system used by thousands of institutions goes down during finals season, it demonstrates that cybersecurity incidents can quickly become large-scale operational disruptions, not just isolated IT problems.\u201d<\/p>\n For updates about the Canvas breach, check the CSU<\/a>, UC<\/a>, and CCC<\/a> websites.<\/p>\n This story is breaking. Check back for updates.\u00a0<\/p>\n","protected":false},"excerpt":{"rendered":"Canvas, the online education management platform used by thousands of educational institutions around the world, is back online…\n","protected":false},"author":2,"featured_media":169255,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[33],"tags":[7,2306,131,133,132,137,100],"class_list":["post-306674","post","type-post","status-publish","format-standard","has-post-thumbnail","category-long-beach","tag-california","tag-higher-education","tag-long-beach","tag-long-beach-headlines","tag-long-beach-news","tag-los-angeles-county","tag-news"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/us-ca\/wp-json\/wp\/v2\/posts\/306674","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/us-ca\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/us-ca\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/us-ca\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/us-ca\/wp-json\/wp\/v2\/comments?post=306674"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/us-ca\/wp-json\/wp\/v2\/posts\/306674\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/us-ca\/wp-json\/wp\/v2\/media\/169255"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/us-ca\/wp-json\/wp\/v2\/media?parent=306674"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/us-ca\/wp-json\/wp\/v2\/categories?post=306674"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/us-ca\/wp-json\/wp\/v2\/tags?post=306674"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}