A cyberattack disrupted access to Canvas at universities and schools in several countries this week, creating confusion for students and staff during a high-pressure period of exams, coursework deadlines and end-of-semester administration.
The hacking group ShinyHunters claimed responsibility for the incident, which affected the academic software platform Canvas, owned by Instructure and widely used by schools, colleges and universities. Institutions in the United States, Canada and Australia reported problems, with some students seeing ransom messages while attempting to complete or submit work.
By late Thursday, Instructure said Canvas was available for most users, though some universities were still reporting problems on Friday. Several affected institutions cancelled or postponed exams, told students not to log in, or moved communications to email while they waited for more guidance.
Students Report Ransom Messages During Exams
At Mississippi State University, officials postponed Friday final exams to give affected students time to recover from the disruption and any lost work.
Aubrey Palmer, a meteorology student at the university, said students had just finished a 2,900-word exam essay when a ransom note appeared on their screens. The message said ShinyHunters had breached Instructure again and threatened to release stolen data unless a ransom was paid in bitcoin.
Palmer said her first reaction was to think her own device had been compromised. After reading the message more closely, she realized it appeared to be connected to Canvas rather than her personal account.
The moment caused immediate confusion in the classroom, she said, with the professor and other students seeing the same warning. It was not immediately clear to students whether their exam work had been saved, and that uncertainty quickly turned into frustration.
Mississippi State later told students it was responding to what it described as a nationwide security incident. The university sent updates by email, rescheduled exams and advised students to ignore suspicious messages.
Campuses Across Several Countries Report Outages
The University of Sydney told students on Friday that Canvas was unavailable and instructed them not to try to log in. The university said it was among roughly 9,000 institutions affected worldwide and was still waiting for advice from Instructure.
The outage affected coursework and exams, the university said, acknowledging the timing was especially disruptive during a critical point in the semester.
In the United States, Idaho State University said it had cancelled exams scheduled after midday local time on Thursday. Penn State University told students that no one had access to Canvas and warned that a resolution was unlikely within the next 24 hours. The university cancelled some exams scheduled for Thursday and Friday.
In Canada, the University of British Columbia in Vancouver told students Thursday evening that Canvas was unavailable because of a cyber breach involving Instructure, and advised users to log out immediately. The University of Toronto also said it had been affected, though the wider scope of its impact was not independently confirmed in the source material.
Students at the University of California, Los Angeles struggled to submit assignments through Canvas, while the University of Chicago temporarily disabled its Canvas page after reports that it had been targeted.
Yubico Security Key C NFC
A hardware security key can add phishing-resistant two-factor protection to supported accounts, including many school, email and password-manager logins. Students should check which services their university supports before buying one.
As an Amazon Associate I earn from qualifying purchases.
Data Concerns Add to Academic Disruption
The disruption was not limited to system access. Some students said the ransom messages raised immediate questions about what data may have been exposed and whether academic or personal information could be released.
The Chicago Maroon, the University of Chicago’s student newspaper, posted a screenshot of a message attributed to ShinyHunters. The message appeared to encourage the university to contact the group privately to negotiate and avoid the release of data.
Northwestern University master’s student Jacques Abou-Rizk said he received the same message after clicking a link in an email that appeared to come from a university administrator. He described the message as alarming and said he did not initially understand what was happening.
Northwestern later sent students an email saying it was monitoring an issue. The message said the university did not yet have an estimated restoration time for Canvas and that other IT systems had not been affected. Abou-Rizk said he was still unable to access Canvas on Friday and remained concerned about both his coursework and the possibility of data exposure.
The group has not publicly clarified what it intends to do with the data it claims to have taken, and that claim has not been independently verified in the source material.
Who Is ShinyHunters?
ShinyHunters has been associated in past reporting with high-profile cyber incidents, though the specific claim connecting the group to a major Jaguar Land Rover hack last year has not been independently verified in the source material and should be treated cautiously.
Screenshots reviewed by a threat analyst at the cybersecurity firm Emsisoft indicated that targeted threats began on Sunday, with deadlines listed for Thursday and May 12. The analyst told the Associated Press that discussions over possible extortion payments could still be taking place.
The Canvas disruption came the same day that Senate Democratic leader Chuck Schumer sent a letter urging the Trump administration to strengthen defenses against cyber risks, particularly as artificial intelligence accelerates the threat landscape.
Schumer wrote that the Department of Homeland Security should help states and localities before outages, disruptions and attacks put lives and livelihoods at risk.
Why the Timing Matters
For universities, the attack landed at one of the worst possible moments. Canvas is often used for exam submissions, assignment deadlines, grading, course announcements and document access. When the platform goes down, the effects can move quickly from inconvenience to academic disruption.
The impact reported by institutions included:
- Cancelled or postponed final exams
- Delayed assignment submissions
- Students unable to access course materials
- Universities moving updates to email and other channels
- Confusion over whether completed work had been saved
The incident also shows how dependent schools have become on a small number of digital learning platforms. When one widely used service is disrupted, thousands of institutions can face the same operational problem at once.
For students, the practical advice from affected universities was straightforward: watch official email updates, avoid suspicious messages, do not click unfamiliar links and wait for institution-specific instructions before trying to resume work through Canvas.
Samsung T7 Shield Portable SSD
A portable SSD can help students keep local backups of essays, notes and project files when a campus learning platform is down. It should be used alongside, not instead of, official university submission instructions.
As an Amazon Associate I earn from qualifying purchases.