A massive cyberattack on Canvas, the popular United States online learning platform used by thousands of schools worldwide, has exposed sensitive personal data of millions of students and disrupted final exams during one of the most stressful times of the academic year.
The breach, linked to the notorious ShinyHunters hacking group, targeted almost 9,000 schools and accessed data from over 275 million people, according to a ransom letter shared online.
Instructure, the company behind Canvas, said hackers accessed names, email addresses, student ID numbers, and private messages. However, the company added that there was no evidence passwords, Social Security numbers, or financial data were exposed.
The cyberattack forced some campuses to temporarily disable access to the learning platform, disrupting coursework, exams, and student communications. Several universities temporarily disabled access while their IT departments raced to determine the extent of the data breach.
Instructure said it detected unauthorized activity on April 29 and later tied the intrusion to an issue involving its “Free-For-Teacher” accounts. The company took Canvas offline on Thursday after login pages were allegedly altered, triggering widespread outages across campuses around the world.
Instructure said it has engaged outside forensic experts and notified law enforcement agencies including the Federal Bureau of Investigation and the Cybersecurity and Infrastructure Security Agency. Most services were restored by Thursday, though some maintenance issues remain under investigation.
Cybersecurity experts warned that the fallout could take schools weeks to resolve as IT teams work to determine whether connected internal systems were also affected. Schools have warned students and faculty to watch for phishing emails and scams tied to the breach.
Instructure has not disclosed how many institutions were directly affected, though the company says Canvas is used by more than 8,000 schools and universities globally. The company said it has made the difficult decision to temporarily shut down its Free-For-Teacher accounts.
