A cyberattack disrupted access to Canvas at schools and universities in the United States, Canada and Australia this week, prompting exam cancellations and postponements and interrupting coursework.
The hacking group ShinyHunters claimed responsibility and threatened to release data it said it had stolen unless a ransom was paid in bitcoin. The group’s responsibility had not been independently confirmed.
Instructure, which owns Canvas, said late on Thursday, May 7, that the platform was “available for most users”. Some universities continued to report outages or restrict access on Friday, May 8.
Exam changes and access restrictions
Mississippi State University moved final exams scheduled for Friday, May 8, to Saturday, May 9, to give affected students time to recover any lost work.
Aubrey Palmer, a meteorology student at Mississippi State, said students had just finished a 2,900-word exam essay when a ransom note appeared on their screens. She said the professor and dozens of other students saw the same warning, creating confusion for students and staff over whether the exam work had been saved. Palmer said she initially thought she herself had been hacked before realizing the note referred to Canvas.
Mississippi State sent updates by email and warned students about suspicious messages. In its May 7 notice, the university described the outage as part of a nationwide security incident and said its internal systems had not been compromised and MSU passwords were not involved.
Idaho State University cancelled final exams scheduled after noon local time on May 7 and throughout May 8. Its guidance said instructors would receive view-only Canvas access from 12:01 a.m. on May 9 to download gradebooks, assignments and other materials. Students would remain unable to submit exams, assignments or projects through Canvas.
Penn State cancelled tests at its Pollock Testing Center for Thursday evening and Friday. After warning on May 7 that it did not expect a resolution within 24 hours, the university announced on May 8 that access would be restored by 1:30 p.m. Some integrations and connected services would initially have limited functionality.
The University of Sydney said on May 8 that it was one of approximately 9,000 institutions worldwide affected by the outage. It instructed staff and students not to log in and said affected examinations would be rescheduled. Students would receive extensions, mark adjustments or alternative arrangements for disrupted assessments.
In a May 9 update, Sydney said its Canvas environment had been restored overnight but remained inaccessible to staff and students while checks were completed.
In Canada, the University of British Columbia in Vancouver said on May 7 that Canvas was unavailable because of a breach involving Instructure. It instructed users not to log in and told those already using the platform to log out immediately. The University of Toronto also said it had been affected.
Students at the University of California, Los Angeles struggled to submit assignments through Canvas.
Data concerns and ransom messages
The disruption was not limited to access problems: the University of Sydney said in a May 6 notice that Instructure had confirmed university data had been affected by a security breach. The university said it was working with the vendor to determine whether personal data had been compromised.
The University of Chicago temporarily disabled its Canvas login page after a message attributed to ShinyHunters appeared on the site. The message urged the university to contact the group privately to negotiate over data it claimed to hold. The university’s IT office said at the time that there was no direct evidence of unauthorized activity affecting its Canvas accounts.
Northwestern University master’s student Jacques Abou-Rizk said he received the same message after clicking a link in an email that appeared to come from a university administrator. He said he was still unable to access Canvas on Friday and was concerned about completing his coursework and the possibility of data exposure.
Northwestern said it was monitoring the Canvas issue. In an email to students, the university said it had no estimated restoration time and that its other IT infrastructure had not been affected.
Luke Connolly, a threat analyst at the cybersecurity firm Emsisoft, said screenshots indicated that targeted threats began on Sunday, May 3, with deadlines on Thursday, May 7, and May 12. He said discussions about possible extortion payments could still be taking place.
