Harvard was among the thousands of schools across the United States affected by the Canvas cyberattack.
Rick Friedman/AFP/TNS
A cyberattack targeting Canvas, a digital platform used by thousands of colleges and K-12 schools across the United States, has disrupted service for millions of its users as many students take final exams to end the spring semester.
ShinyHunters, the hacking group that claimed responsibility for the attack, claimed in a ransom note that it had obtained data on millions of people, including personal conversations involving teachers and students.
Article continues below this ad
Instructure, Canvas’ parent company, said in a message on its website late Thursday that the service was available for most users. But both Canvas Beta and Canvas Test remain in “maintenance mode,” the message said.
The cyberattack appears to be a ransomware incident, in which hackers threaten to release data or keep systems locked up with passwords unless a ransom is paid.
Canvas cyberattack during final exams
The service disruption occurred as many students are taking finals or nearing the end of the spring semester. The Canvas platform is used to manage grades, notes, assignments and lecture videos, among other things, according to The Associated Press.
Article continues below this ad
Colleges and universities began notifying users Thursday that the service was down.
The University of Michigan said it temporarily was removing access to Canvas while it investigated, and directed users who still were logged in to log out immediately. Harvard University said its IT service was “aware that the Canvas platform is currently unavailable due to a cyber incident.”
The University of Texas at San Antonio said it was pushing back assignment due dates and exams because of the disruption. The school said nearly 9,000 institutions were affected nationwide.
Article continues below this ad
When did Canvas cyberattack happen?
In a message posted to its website on May 1, Instructure said it had “recently experienced a cybersecurity incident perpetrated by a criminal threat actor.” The statement, attributed to Chief Information Security Officer Steve Proud, said the company was investigating.
In an update on May 2, company officials said they had taken security steps since becoming aware of the incident, which they believed was “contained.”
Instructure said the incident involved “certain identifying information of users at affected institutions, such as names, email addresses, and student ID numbers, as well as messages among users.”
Article continues below this ad
“At this time, we have found no evidence that passwords, dates of birth, government identifiers, or financial information were involved. If that changes, we will notify any impacted institutions,” the company said on May 2.
A message from ShinyHunters that appeared on students’ Canvas pages when they went to log in claimed the hacker group had “breached Instructure (again).”
“Instead of contacting us to resolve it they ignored us and did some ‘security patches,'” the message said. It threatened to leak schools’ data unless a “settlement” was reached.
A May 3 ransom letter that was posted by ransomeware.live, which tracks ransomware incidents, claimed nearly 9,000 schools were affected and that the incident involved the data of 275 million people, including “billions” of private messages.
Article continues below this ad
“This is a final warning to reach out by 6 May 2026 before we leak along with several annoying (digital) problems that’ll come your way,” the message said.
What US schools were affected by Canvas cyberattack?
The U.S. schools known to have experienced issues from the Canvas cyberattack include:
Article continues below this ad
Columbia University
Cornell University
Georgetown University
Harvard University
Johns Hopkins University
Kent State University
Massachusetts Institute of Technology
Princeton University
Rutgers University
Stanford University
University of Michigan
University of Oxford
University of Texas at San Antonio
Virginia Tech