Canvas Hack Throws US Campuses Into Chaos Right as Finals Begin

USA Today, CNN, CBS News, the Verge contributed to this report.

Students across the US logged into Canvas this week expecting lecture notes, grades and last-minute study guides. Instead, many were greeted by a ransom note from a hacking group.

The widely used learning platform, operated by Instructure, went down for hours on May 7 after what universities described as a major cybersecurity incident. The outage hit during one of the worst possible moments: spring finals season.

Schools including Harvard University, University of Michigan, Pennsylvania State University, Georgetown University and Northwestern University warned students that Canvas access had been disabled while investigations were underway. Other colleges from California to Florida reported similar disruptions.

By Thursday evening, Instructure said the platform was “available for most users” again after earlier placing Canvas into maintenance mode. But for students scrambling to finish papers, review lecture recordings or submit assignments, the damage had already landed.

The hacking group ShinyHunters claimed responsibility for the breach. According to reports from CNN and The New York Times, the group said it had accessed data tied to more than 275 million people across nearly 9,000 schools worldwide. Instructure, which says Canvas serves more than 30 million active users and over 8,000 institutions, previously acknowledged a separate cyber incident earlier this month involving names, email addresses and student ID numbers.

Some students discovered the breach in real time. Instead of dashboards and coursework, Canvas pages displayed messages from the hackers demanding contact before May 12 to avoid further leaks.

At University of Pennsylvania, junior Anish Garimidi said he was studying for finals when he was suddenly locked out of the system.

“The biggest cause of fear and anxiety in me is that I was deprived of significant resources to study and do the best,” he told CNN.

Others reacted with a little less panic. Georgetown sophomore Minhal Nazeer said some students were quietly relieved because professors immediately began extending deadlines.

Universities moved quickly to improvise. University of Illinois Urbana-Champaign postponed exams scheduled through the weekend, even for classes that didn’t normally use Canvas. James Madison University pushed exams back until next week.

The outage also exposed just how dependent colleges have become on a single digital platform. Many professors suddenly found themselves without a direct way to contact students because announcements, assignments, grading and messaging all flowed through Canvas.

“All of their communication infrastructure basically lives there now,” said Allison Park, a junior at Massachusetts Institute of Technology.

Professors, she said, were scrambling to track down student email addresses after the platform disappeared.

Cybersecurity experts said the incident should serve as a wake-up call. Joseph Steinberg, a lecturer at Columbia University, noted that schools often treat cloud systems as failproof until something breaks at exactly the wrong moment.

“There is no cloud,” Steinberg said. “It’s just somebody else’s computer.”

The disruption may fade in a few days. Finals week stress probably won’t.