A major cyberattack has disrupted access to the widely used Canvas learning platform, affecting thousands of schools and universities across the United States during final exam season. Institutions including Harvard University, University of California, California State University, and University of Texas at San Antonio reported outages or delays linked to the incident.
The attack targeted Canvas, the online learning system operated by Instructure, which is used for assignments, grades, exams, messaging, and course materials. The hacking group “ShinyHunters” claimed responsibility and reportedly issued ransom demands while threatening to leak stolen data.
According to reports, the compromised information may include:
Names
Email addresses
Student ID numbers
Messages between students and instructors
So far, there is no confirmed evidence that passwords, Social Security numbers, or financial information were exposed.
.jpg "\"Nationwide Cyber Attack Leaves US Universities and Schools Reeling\"")
The outage caused widespread academic disruption:
Some students were kicked out of online finals mid-exam.
Universities postponed assignments and tests.
Schools advised students and staff to watch for phishing emails.
Canvas systems were temporarily placed into maintenance mode while investigators responded.
Security analysts say the breach highlights how dependent schools have become on centralized digital learning systems. Canvas is used by millions of students worldwide and reportedly serves nearly 9,000 educational institutions.
A major cyberattack disrupted the widely used learning platform Canvas by Instructure on Thursday, affecting thousands of schools and universities across the United States during final exams and end-of-semester deadlines.
The hacking group ShinyHunters claimed responsibility for the attack and reportedly threatened to leak stolen student and institutional data unless affected schools negotiated a settlement by May 12.
Universities impacted included:
Pennsylvania State University, which warned students that Canvas access could remain unavailable for at least 24 hours and cancelled some exams.
University of California, Los Angeles, where students struggled to submit coursework.
University of Chicago, which temporarily disabled its Canvas page after reports of targeting.
According to reports, attackers altered some Canvas login pages to display ransom messages. Screenshots circulating online showed warnings that data from nearly 9,000 schools and up to 275 million users could be exposed, though the full scale has not been independently verified.
Instructure said Canvas was later restored “for most users,” although some services remained under maintenance. The company has acknowledged that exposed data may include names, email addresses, student ID numbers, and messages exchanged on the platform, but said there was no evidence that passwords, financial data, Social Security numbers, or government IDs were compromised.
Cybersecurity analysts said the incident appears to be part of a broader extortion campaign by ShinyHunters, a group previously linked to high-profile breaches involving major technology and consumer companies.
The attack also drew political attention in Washington. Chuck Schumer urged the Trump administration to strengthen cybersecurity protections for schools, states, and local governments amid rising AI-driven cyber threats.