Chaos erupts as cyberattack disrupts learning platform Canvas amid finals

A significant disruption unfolded across educational institutions in the United States on Thursday as a cyberattack targeted the online learning platform, Canvas, right when students were preparing for their final exams. The platform, owned by Instructure, was taken offline temporarily after the company detected unauthorized activity within its network. By Friday morning, Canvas was restored, but the incident raised serious concerns. Instructure confirmed that the cyber threat was linked to a data breach it reported just a week prior. The compromised data included usernames, email addresses, student ID numbers, and messages from the platform. Fortunately, Instructure stated that there was no evidence suggesting that more sensitive information, such as passwords, dates of birth, government identifiers, or financial details, had been exposed. Responsibility for the breach has been claimed by a ransomware group known as ShinyHunters, which announced on its dark web site that it had accessed data from approximately 275 million individuals associated with nearly 8,800 schools. During the exam period, students attempting to log into Canvas were met with a ransom demand, indicating that Instructure had previously rejected the group’s demands and advised schools to negotiate independently. The attack prompted immediate action from many educational institutions. The University of Illinois decided to postpone all final exams and assignments originally set for Friday through Sunday. Similarly, UMass Dartmouth adjusted its exam schedule, extending deadlines for students. The University of California system also instructed its campuses to respond accordingly. Canvas is not alone in facing such cyber threats; last year, PowerSchool, which serves 60 million students across 16,000 K–12 schools globally, disclosed a breach that compromised extensive sensitive data, including names and addresses. ShinyHunters has been operating for years, previously breaching cloud storage provider Snowflake and using the stolen credentials in attacks against various clients, including TicketMaster.