Canvas online again as ShinyHunters threatens to leak schools’ data

Canvas online again as ShinyHunters threatens to leak schools’ data(theverge.com)

921 points by stefanpie 56 days ago | 648 comments

https://thetech.com/2026/05/07/canvas-breach-26

https://techcrunch.com/2026/05/07/hackers-deface-school-logi...

blahedo 56 days ago |

Perspective from the trenches: I teach at a university that uses Canvas. We are in our final exams period right now.

We got our first email (from Academic Affairs) notifying us that it was down at 5:17pm EDT this afternoon, with little info; followup emails were sent at 6:24 and 6:57 with more info, but mostly about how we would be compensating for it and not about what actually was going on (other than, "nationwide shutdown" and "cybersecurity attacks", no further detail). I don't get a sense that they know much more than that, not that I would expect them to.

A perhaps telling detail: they're instructing us to have students email us directly with any work that had been submitted via Canvas. That suggests that they have no particular confidence that it will come back up soon.

I personally am only slightly affected; as a CS professor a lot of my students' work is done on department machines, and submitted that way, and I do the actual exams on paper. More importantly, I've never liked or trusted Canvas's gradebook, and so although I do upload grades to Canvas so students can see them, my primary gradebook is always a spreadsheet I maintain locally.

But I have a lot of colleagues for whom this is catastrophic at a level of "the whole building burnt down with all my exams and gradebooks in it"---even many of those that teach 100% in person have shifted much or all of their assessment into Canvas (using the Canvas "quiz" feature for everything up to and including final exams), and use the Canvas gradebook as their source-of-truth record. We've been encouraged to do so by our administration ("it makes submitting grades easier"). For faculty in that situation, they have few or zero artifacts that the students have produced, the students themselves don't have the artifacts to resubmit via email because they were done in Canvas in the first place, and they have no record of student grades or even attendance (because they managed that all inside Canvas). I guess they have access to the advisory midterm grades from March, if they submitted them (most do, some don't), but that might be it.

My gut feeling on this is that this is either resolved in hours (they have airgapped backups and can be working as soon as they can spin up new servers), or weeks (they don't). Very little in-between. And if that's true and we wake up tomorrow with this unresolved, I really have no idea what a lot of professors at my university and across the country are going to do to submit grades that are fair and reasonable. In the extreme case, they may have to revert to something we did in the pandemic semester (and before that, at my school, in the semester that two major academic buildings actually did burn to the ground a week before finals): let classes that normally count for a grade just submit grades as pass-fail. Because what else can you do?

(Well, one thing you can do is not put your eggs all in one basket, and not trust "the cloud" quite so much, but that ship's already sailed. I do wonder if in the longer term, anybody learns any lessons from this....)

UPDATE: As of 11:45pm EDT, my university's canvas instance is up and running! Here's hoping it stays (but I'll be downloading some stuff just in case...)

JumpCrisscross 56 days ago | |

> the students themselves don't have the artifacts to resubmit via email because they were done in Canvas

It’s so simple to send an e-mail to the student with relevant records on completion of a quiz or whatnot. They don’t do it, because they want to control the data. (And universities don’t insist on it for who knows what reason.)

gucci-on-fleek 56 days ago | | |

I've never used Canvas before, but all the LMSes that I've used allow students to enable emails whenever anything is updated, including when grades are posted. This is off by default because it's often 10+ emails a day, because many teachers post notes once a day, and with 5 classes, that adds up pretty quick. I personally have it enabled because it's pretty manageable with some custom Outlook rules, but setting this up is well beyond the capabilities of most students.

e28eta 56 days ago | | |

Students having records of what their score was doesn't prove to the professor / university what score they received. "FWD: Exam 1 Results" is not especially auditable.

MarsIronPI 56 days ago | | |

Makes me glad I've always avoided doing my work on web platforms. When we used to have to make presentations in Google Slides I used to do them in Org-mode, then export to Sheets. I still have all those assignments sitting on my disk. Sure, there's versions of them on Google Drive, but I always make sure that the canonical version is the one on my disk.

moralestapia 56 days ago | | |

>It’s so simple to send an e-mail to the student ...

What seems easy on hobby projects gets way more difficult at scale. Source: experience.

bartread 55 days ago | | |

> They don’t do it, because they want to control the data.

Ironically, this incident shows they don’t have control of anything.

rupx 56 days ago | |

I work in the Education sector as IT. We don't know much else either.

Everything we know has come from reddit threads / hackernews threads. There has been 0 official communication today indicating this was an attack, yet the login page was defaced by ShinyHunters.

setopt 56 days ago | |

Just to add one more data point, we also use Canvas at my university. The deadline for submitting who are eligible (i.e. passed compulsory assignments and labs) to take the exam was yesterday, and I couldn’t meet that deadline because Canvas went down. I usually do corrections offline so I have backups of my own evaluations, but these are courses with many teachers and many TAs, so Canvas is the way we sync our assessments.

p-e-w 55 days ago | | |

I guess what surprises me the most is that it’s even legal for schools to outsource the core of what they do to some random tech company.

Either way, they were under no obligation to adopt this garbage technology regardless of whether it’s available, so this is 110% on them.

beej71 55 days ago | |

> I've never liked or trusted Canvas's gradebook, and so although I do upload grades to Canvas so students can see them, my primary gradebook is always a spreadsheet I maintain locally.

That makes you one better than me. :( One thing's for sure--I'm never trusting it again.

I already had almost all my materials outside of Canvas and just used their API to upload it. So at least that's safe. But the grades... dang. Luckily we're only halfway through our quarter and it's not finals week.

Our instance is still down, but your update gives me hope.

jodrellblank 55 days ago | |

> “My gut feeling on this is that this is either resolved in hours (they have airgapped backups and can be working as soon as they can spin up new servers)”

What good is having airgapped backups and spinning them up, if they are instantly vulnerable to the same attack again?

It does depend on what the attack is, but how do people approach that scenario?

butlike 55 days ago | | |

That's an interesting question and one I'd like to know an answer to as well.

camillomiller 56 days ago | |

To my European ears this just sounds like a disaster like this waiting to happen. God bless the annoying privacy OSS advocates and bureaucrats, I guess.

gwerbin 55 days ago | | |

As someone else in the thread pointed out: Canvas is in fact open source, or at least source available on Github. And it's used all over the world, not just in the USA.

drillsteps5 55 days ago | |

Canvas is back up as of Friday US morning for me (HS student's parent). My kid got a few panicked emails yesterday from the teachers but it looks like Instructure got it resolved quickly.

Canvas does provide a lot of value (all courses, teachers', students', and parents' contact information, all learning plans, schedules, room numbers, all grades, a lot of tests and assignments themselves, all upcoming assignments and deadlines, a lot of other coursework is in there, as are the final grades) but it shows that with external SaaS you might be one attack away from not only losing all that convenience but also in a world of hurt 'cause you lost all the data and now have to figure out how to proceed without the data and the system.

US high schools are in the middle of the finals, and seniors are getting ready for college (the transcripts to be finalized and sent out in a few weeks) so that was a scary timing.

F7F7F7 54 days ago | | |

Instructure got their systems back up but they but their handling of that student data is unacceptable.

jonstewart 56 days ago | |

Backups are definitely helpful in ransomwares, but before systems can be restored and brought back online, victim organizations still need to assess the scope of the breach, find the initial access vector, identify compromised accounts, and evict the threat actor. That can take time.

garciasn 56 days ago | | |

I’m not certain, but it appears you’re giving Instructure a pass here, as if this is the first time they were hacked. But, it’s the second, by the same group.

As a parent of kids who are impacted by this, I’m not super concerned about the data being held for ransom, but I sure as fuck am concerned about how much it’s going to cost the district to move to another provider.

dumbfounder 56 days ago | |

Maybe a hybrid approach. Scramble to create a final exam/project and give them the option to do pass/fail or a real grade, their choice.

And then wish for the death of saas and a day where you can deploy your own software you can control and modify as you need.

Avicebron 56 days ago | | |

What is the strategic response then? Assuming I'm a student and my grades are gone, and I want to graduate, shouldn't I pick pass/fail?

Does a future employer look at pass/fail vs the grade? do they care? Are there even jobs that matter enough to care out there for them?

This seems like, solving the problem but without actually seeing the broader goal or trajectory education is supposed to follow.

flexagoon 56 days ago | | |

> day where you can deploy your own software you can control and modify as you need.

Canvas is mostly FOSS

https://github.com/instructure/canvas-lms

grey-area 55 days ago | | |

Universities are not going to write their own software, and no they can’t use ‘agents’ to write and maintain it for them either.

fastasucan 52 days ago | | |

You cant really do that in lots of cases. What grounds the grade is from is in many cases set in stone.

apublicfrog 55 days ago | |

All these articles listing the American schools affected, "nationwide" outage reported, meanwhile hundreds of millions in the rest of the world affected.

Does anyone have a list of affected schools?

isakmarr 55 days ago | | |

I don't have a list, but I can tell you the University of Iceland is affected.

butlike 55 days ago | |

> And if that's true and we wake up tomorrow with this unresolved, I really have no idea what a lot of professors at my university and across the country are going to do to submit grades that are fair and reasonable

I have an idea for the midterm (pun intended): Maybe don't jump feet first into the deep end of a single point of failure going forward.

roody15 55 days ago | |

Think they will end paying the ransom quietly.

addedGone 55 days ago | | |

100%, else goodluck with the lawsuit coming from the students, as the schools are the one liable for not securing their system.

vasco 56 days ago | |

> let classes that normally count for a grade just submit grades as pass-fail. Because what else can you do?

Schedule a single exam and that's your grade for that subject? That's how it should work anyway, credits for work during semester (or worse attendance) are not needed to evaluate if someone learned the material, give them an exam and done.

goobatrooba 56 days ago | | |

That's just bad outdated practice. It leads to cramming and less remembering than of the demand is for students to do work and show learning and effort throughout the year.

blahedo 56 days ago | | |

That's maybe something a school can do if exams are next week, or after.

At my school, tomorrow is the last day of exams. Most of the students have left campus. There's no time or mechanism to schedule an(other) exam.

pishpash 56 days ago | | |

Exams have performance variance. Otherwise you're only getting a pass/fall signal in any case.

Nagyman 55 days ago | | |

That feels like a poor statistical evaluation. Why not test along the way with progressive complexity/depth?

Using attendance is a carrot to get students to show up, which leads to better learning outcomes overall - which should be the goal.

scubadude 56 days ago | | |

Then you're testing how good someone is at exams as much as anything

SoftTalker 56 days ago | |

> they have airgapped backups and can be working as soon as they can spin up new servers

... and assuming they have a documented, tested, and trusted restore process.

yongjik 56 days ago | | |

Reminds me of the incident last year when a South Korean government's server room caught fire, which contained the government equivalent of Google Drive, and the only backup was in the same room, and they all burnt down together.

Some data was permanently lost, and then officers told reporters that multi-regional backup was not yet built because it was too hard at such a massive scale... of 858 TB.

rayrey 56 days ago | | |

Ah yes the “recovery” part of the continuity plan. We tested that right? Right?

copperx 56 days ago | |

I don't understand what's the panic and doomerism about. Any competent IT team has backups and will be up and running as they go back to a state before the breach. This is HN. I'm disappointed that everyone is talking about losing grades and going back to pen and paper. I don't see how that could happen in 2026.

And from the hacker's message itself, it's clear they want money in exchange for not releasing private info, not for the data itself.

Do we live in a fear based culture? Why the panic? Even if everything was hosted on Instructure's infrastructure, it's all AWS. I'd be VERY surprised if there aren't multiple way to go back to a previous state.

Most of the work and delay is to make sure they figure out where the breach occurred.

simonreiff 55 days ago | | |

I'm sure you're right. Across tens (hundreds?) of thousands of institutions worldwide, each one is exercising its well-written incident runbook that not only gets updated regularly but also is rehearsed constantly, just in case something like this happens. After all, what university IT department DOESN'T prepare obsessively for the moment when they need to restore all grades on all assignments for all courses from backup and fall over to the backup system for final exam administration in any required format specified by any professor, in the second week of May, on a non-negotiable schedule? There's absolutely nothing to worry about here.

yread 56 days ago | | |

Schools don't have competent IT teams.

Here in the Netherlands a data center's power source (not even the machines) burnt down, data center is offline and University of Utrecht, one of the biggest universities here, is closed. Access passes don't work, work from home environment doesn't work, student information system is down, system for grading doesn't work. No failover for any of them (or maybe it was in the same DC?)

https://nos.nl/artikel/2613485-storingen-in-hele-land-door-b...

mschuster91 56 days ago | | |

> Any competent IT team has backups

Backups can be sabotaged (turned off or schedules manipulated) or compromised (say, by lateral movement).

> Even if everything was hosted on Instructure's infrastructure, it's all AWS.

AWS Backup isn't foolproof. Get your hands on administrator credentials as an attacker and suddenly the only thing between everything being gone for good and unrecoverable even for AWS is remembering to have put a permanent deletion protection on all resources in AWS Backup.

pjc50 55 days ago | | |

Sometimes it is very hard to recover from the offlining of essential systems: https://www.bbc.co.uk/news/articles/cy9pdld4y81o (Jaguar Land Rover, estimated cost in the billions)

belabartok39 55 days ago | | |

I fully agree. What really pisses me off is that these "hacker" groups always spout off how they are doing it to screw the man but then threaten the average person. Millions of them. It just goes to show how uneducated, low-class, and simple these people really are.

Gabriel54 56 days ago |

I'm surprised how few comments there are on this thread. This is probably affecting millions of students at the most stressful time of the year.

Incidentally I've always hated Canvas and probably every other LMS provider, but what is particularly amusing about this current outage is that it is occurring at exactly the time when universities are demanding that all professors put all of their materials on Canvas, without exception, due to ADA compliance regulations. It is explicitly forbidden for professors to, e.g., refer to pdfs posted on a personal website.

Other commentators here seem not to understand that many faculty also do not enjoy being forced to use Canvas.

myrandomcomment 56 days ago |

1. It should be illegal for any company to pay ransomware attacks. Period. No pay out ever. 2. The penalty for being the attacker should be linked to the system they violated. If you do this to a hospital and someone dies you are life in prison / chair. The minimum sentence should be so painful that it deters the attack.

No this will not stop this and companies need to be held accountable for their lack of security investment. Every attack should be investigate if the company met an agreed industry standards best practices and staffing, etc. The penalties for not meeting the requirements should be punitive.

kelnos 56 days ago |

A friend who teaches at MIT said they were hit by this. I found it ironic and a little sad that a place like MIT doesn't have an IT staff that can maintain their own on-prem solutions for things like this.

But it turns out that MIT used to have their own homegrown system, and recently switched to Canvas. Bet they're regretting that now.

The build vs. buy decision seems to have swung very hard toward buy in the last decade, and I think that's a shame. Yes, orgs need to focus on their core competency, and sometimes that means outsourcing things that aren't core competencies to third parties. But there are always downsides.

BooneJS 56 days ago |

My kids are in the middle of their finals week. What a mess. Universities know nothing, Canvas claims to be in a "scheduled maintenance", and one Prof claims to "not have any copies of material offline" which seems pretty negligent. Sounds like one section of a popular class will be doing paper exams while other sections had Canvas-based "half points for 2nd attempt"-type exams earlier today. How soon before names & grades appear in data dumps?

This would be like TurboTax "scheduling maintenance" on April 14th in the US.

eiiot 56 days ago |

I'm a student at Stanford — this is hitting the whole school hard. Unlike a lot of schools on the east coast that are affected (Brown, Harvard, MIT) we are on the quarter system so we're just ending Midterms right now. We're also lucky enough to have our CS department entirely independent from Canvas, but most of my humanities classes are not so lucky. One art history class is having us submit our midterm papers by uploading to a google drive folder—another is pausing weekly quizzes. The main thing this has revealed is just how dependent students and teachers are on Canvas... I hope that this re-prompts discussions about moving off of a platform that was already (from a student perspective) not very good.

zuzululu 56 days ago | |

I really feel like SH fucked up by sinking this low hitting students and Americas young minds like this....

One thing to target coroporations but leave the students alone....

JCharante 56 days ago | | |

It's not so bad, I'd say the Christmas PS3 hack was worse

noitpmeder 56 days ago | |

And what's your opinion on the em dash?

eiiot 55 days ago | | |

That it tends to provoke unproductive comments like this one. https://news.ycombinator.com/newsguidelines.html#comments

mizzao 54 days ago | | |

The fact that one of the em dashes has spaces around it, and the other does not, makes it more likely to be handwritten.

I personally love em-dashes and hate that they're a sign of AI writing now.

corvad 56 days ago |

Canvas is handling this terrible. No communication, no status updates, etc. Also looks pretty bad their whole platform was compromised and not a single real report for the breach that already had happened. Wonder how long it will take for SLA violations and lawsuits to manifest, especially with most U.S. schooling having finals right now.

user3939382 56 days ago | |

Lot of experience dealing with Canvas/Instructure. Tech is o-k. Culture seems to be full of themselves due to market position.

corvad 56 days ago | | |

Yeah like their page says "Scheduled Maintenance" which is total B.S. Talking to people at my university's IT side of things Canvas has said nothing to any clients.

jeffwask 55 days ago | |

Fixed it for you.

Also looks pretty bad their whole platform was compromised by the same hacker group again.

thecatapps 56 days ago |

I remember when I was in high school (2016? 2017?), I found a super simple XSS in the assignment submission form and told the programming teacher. Canvas then proceeded to lock my account and got me my first (only?) detention. Good times.

somebudyelse 56 days ago | |

Somewhat similar vein, the school's blocking software would block YouTube and embeds unless they came from Canvas. They were smart enough to disable the HTML editor for posting discussion comments, but forgot that since it was a rich text editor, you could just copy-paste in an embed by putting the code in data:text/html, then copying the element as formatted html.

I also ran the entire DOMPurify sample XSS and managed to find one way to download custom content onto someone's computer.

frollogaston 56 days ago | |

Uh, did you tell the teacher by exploiting the vuln?

SoftTalker 56 days ago |

So many universities used to run homegrown or on-prem student systems. This is the downside of consolidating in the cloud. If the infrastructure is compromised, it affects everyone, not just isolated or single installations. I wonder how they are feeling about that decision now? I guess they can say "not our fault" so they might be feeling better than if it was a vulnerability in their own system.

matthewfcarlson 56 days ago |

I remember circa 2010 a friend of mine at college was like “blackboard sucks, let’s build something new”. At the time I poo pood the idea and lo and behold canvas came out a year later. Outside looking in, they been crushing it.

rahidz 56 days ago |

Goddammit. Anyone in the know, know if Parchment was also impacted by this potentially? They were acquired by Instructure a few years ago, and deal with a LOT of transcripts.

Edit: https://status.parchment.com/ says "While Canvas, Canvas Beta and Canvas test are currently unavailable, we are simultaneously monitoring all of our other product environments, including Parchment. We continue to see no reason to believe any Parchment resources have been impacted."

exprez135 56 days ago |

The Canvas instance at the nearby university is now down (May 7, 4 PM Eastern), but was briefly displaying the message in this screenshot (1). The ransom message implies that today's problem is the second wave in an attack on Instructure after ignoring their first breach in recent days.

1: https://ibb.co/r29RjdnH

HDBaseT 56 days ago | |

Yeah, this is ongoing.

We received communication that Canvas is down for "Under Maintenance" although it seems ShineyHunters have compromised Canvas again with that message you posted.

We do not see that message anymore, although all instrucuture.com URLs are down. The list of schools in the ShinyHunters publication can be found here: https://web.archive.org/web/20260507042014/http://91.215.85....

GaryBluto 56 days ago | | |

https://web.archive.org/web/20260507042014fw_/http://91.215....

Original now shows 404.

nebula8804 56 days ago | | |

Seems like Canvas instances of schools not listed are also down (at least my alma mater is)

sharkweek 56 days ago |

My wife is in grad school at a major university and is dealing with this right now the week of midterms for spring quarter.

I totally understand why a university wouldn’t want to bake their own learning portals but just feels like such a single point of risk to use third party solutions for something like this.

Back in my day… all we had was a school email via on-premise services. I guess we registered for classes in a web portal but that’s about it. The idea of online class was entirely foreign at the time. Ain’t nobody hacking a blue book.

SoftTalker 55 days ago |

> ShinyHunters ... said its data leak site contains 9,000 schools, including data belonging to 275 million students

Brought up a question I've had every time I read about these leaks... what kind of pipes do these shadowy groups have that they can grab all this data? I've spent days waiting just downloading a few 100 of GB from OneDrive. How do they grab all this data, are they just slowly gathering it for months via a compromised desktop somewhere, or if not, are the companies not monitoring for unexpected massive amounts of outbound traffic from their database or file servers?

organsnyder 55 days ago | |

I'd assume they have a botnet to parallelize it. Though depending on where you live (not that they'd be using their own machines) fast pipes are fairly common—I have a 5gbps symmetrical fiber connection to my home in Michigan.

cocoacat 56 days ago |

Also here: https://news.ycombinator.com/item?id=48054386

HDBaseT 52 days ago |

Canvas has paid the ransom.

QUOTE

To our Instructure Community,

We know that for many of our customers, concerns about the potential publication of data related to this incident remain top of mind. We want to acknowledge those concerns directly – we understand how unsettling situations like this can be, and protecting our community is also a top priority for us.

With that responsibility in mind, we reached an agreement with the unauthorized actor involved in this incident. As part of that agreement, the data was returned to us, we received assurances that it will not be further shared on the dark web or elsewhere, and we received proof that any copies of that data were deleted. Further, we have been informed that no Instructure customers will be extorted as a result of this incident, publicly or otherwise. While there is never complete certainty when dealing with cyber criminals, we believe it was important to take every step within our control to give our customers additional peace of mind, to the extent possible.

We are sharing this update in the continued interest of transparency and so that our customers know that we have addressed this element of the incident directly. To reiterate, the agreement covered all of our customers, and there is no need for individual customers to attempt to engage with the unauthorized actor.

We appreciate your patience and trust as we continue to respond to this incident thoughtfully and comprehensively. We remain committed to providing meaningful updates as our work progresses.

Regards,

Steve Daly, CEO, Instructure"

END QUOTE

tptacek 56 days ago |

The boy is a biochem PhD student at UIUC and reports that all their finals are now cancelled. "Is this good news?" I ask. "Yes. Everything coming up Milhouse."

tom1337 56 days ago |

> Canvas is currently undergoing scheduled maintenance

doesn't seem that scheduled to me

javawizard 56 days ago | |

ex-Instructure employee here (though it's been about 10 years since I worked for them).

That's just the quickest page/status update to throw up; it was a one-liner to push it live back when I was on the deploy rotation.

I'd hazard a guess they have more important things to worry about right now than exact status page messaging ;)

chrisjj 55 days ago | | |

> That's just the quickest page/status update to throw up

Funny how a lie is always quicker than the truth...

podiki 56 days ago | |

I thought the same. The "scheduled" part of the message is gone now, at least on the instance I use.

anematode 56 days ago | |

Well, scheduled by whom? :)

mystraline 56 days ago | | |

Whoever it is, is likely defended by Cloudflare. They seem to like the booters.

https://news.ycombinator.com/item?id=48025001

incomplete 56 days ago |

yep, i work for a major university and our canvas instance is down. this is really, really bad.

edit: here's the list of impacted universities (unsure if they all have their canvas instances offline, but i'd be surprised if not): http://91.215.85.103/pay_or_leak/instructure_affected_school...

xd1936 55 days ago |

Official cybersecurity insurance company required FAQ:

https://www.instructure.com/incident_update

owlboy 55 days ago | |

The way they describe it as an issue with free accounts seems vague and misleading. Why would _any_ account have this broad of access? Why would free ones be uniquely insecure vs official ones?

This suggests a bad actor at any institution could do the same thing done here. No?

robertritz 56 days ago |

I'm shocked universities don't host their own LMS? At least large universities have the IT departments to do this. They host compute clusters, so they can certainly host an LMS.

oezi 56 days ago | |

The same reason hospitals don't have their own Patient Information System but all use Epic. The amount of customization you need and continuous churn due to changing curricula and regulatory requirements makes it hard to keep up without scale.

somebudyelse 56 days ago |

It looks like Instructure has been removed from the ShinyHunters website. Both the entry and the list of schools has been removed.

bombcar 56 days ago | |

Look for large BTC moves recently?

corvad 56 days ago | |

Ransom paid?

bumblehean 56 days ago |

Hugs going out to the teams at Instructure working to fix this. I've been through a similar Ransomware attack (national news stories, lots of customers dead in the water, etc.), and it's about as bad a situation you can wind up in.

orourke 56 days ago |

My son was in the middle of an exam and then his screen went black and it showed the message from ShinyHunters. Hasn’t been able to get back in since.

nxobject 55 days ago |

I'll be shocked if Canvas ever gets held publicly accountable for this.

I believe FERPA's PII provisions apply to Canvas and contractors handing PII in general (at least as interpreted by the Department of Education). Now, will Canvas be held accountable by ED in this administration? Hah – DOGE probably ran that through the shredder as well.

1970-01-01 55 days ago | |

Depends on how bad it gets. Most likely nothing will happen however if they leak the PII of enough of the rich and powerful then you can expect lawsuits.

avs733 56 days ago |

It is absolute chaos at my institution. This is the last day of finals and grades are due Monday morning. Most faculty are spending today, tomorrow, and through the weekend finalizing grades.

What we don't have access to includes:

* Already graded work

* Ungraded work

* overall adn assignment grades

* lists of students and student emails from the course

* messages from students that are often sent through gradescope

Just...complete implosion.

pesus 56 days ago | |

What happens if the system isn't back up in time for grades to be submitted? Just a delay?

tech234a 56 days ago |

A post on the official Canvas forum: https://community.instructure.com/en/discussion/666027/ranso...

OsrsNeedsf2P 56 days ago |

Somehow I have less distaste for ShinyHunters than I do for the companies who don't secure user data

rixed 56 days ago | |

When you picture the attacker, don't picture a bored nerdy teanager. Picture a selfish, $$ motivated psychopath.

Let's not side with the parasites.

chrisjj 55 days ago | | |

And lets not side with Canvas PR.

corvad 56 days ago |

Just learned the defacement page was hosted from instructure's own aws bucket so seems pretty bad.

SeanAnderson 56 days ago |

https://status.instructure.com/ implies Canvas became available again about thirty minutes ago from the time of this post.

Is this accurate? Or is this still an ongoing issue?

podiki 56 days ago | |

Ongoing. It is not "down" but purposefully offline for "maintenance." Main status does show the LMS (all the course stuff) down, and my instance shows "up" but that's because (I assume) you can reach it and the maintenance page. But that's not useful, if technically not "down."

SeanAnderson 56 days ago | | |

Thanks

boldi 56 days ago | |

Canvas LMS is the core service that universities rely on. I assume they're trying to develop a fix and that's why the service is labeled "Under Maintenance". I'm a Berkeley student and can confirm that our instance (bcourses.berkeley.edu) is still down.

owlboy 56 days ago | |

Federated logins appear to now be broken for the campus I’m affiliated with. So more action is needed.

owenpalmer 55 days ago |

I tried to become a contributor to Canvas (it's open source), but I couldn't even get a development environment setup because of their storage space requirements.

https://github.com/instructure/canvas-lms/wiki/Quick-Start

> It is recommended that you have at least 150GB of available hard drive space, 8GB of RAM, and a quad-core CPU to use this script.

As far as I can tell, this is not for running a production environment with assets. This is just the development environment.

dlcarrier 55 days ago | |

I long for the days when FPGA development environments were an order of magnitude more bloated than software development environments. I've tried, on multiple occasions, to build an open-source Android application, and each time I've given up after a few hours of trying to get all the bloat working together well enough to even compile something already written.

poopmonster 56 days ago |

Student at an impacted university here.

Our whole testing center is down. This is inconvenient, but mainly it's amusing. I swear strangers are talking to each other more. I'm noticing people just sitting in the sun and relaxing. Nature is healing.

(Of course, plenty of people have also just finished their exams, so it's hard to know the cause.)

Any idea what data Instructure-and-also-now-ShinyHunters even purport to have beyond names, profile photos, pronouns, homework assignments, school communications, phone numbers, and email addresses?

i.e. What makes this threat so different from what any old data brokers have already scraped?

What leverage besides aura farming do the ShinyHunters really have?

All I can think of that's really valuable is passwords. And private communications in Canvas DMs. But if you're being at all intimate over your school email, that's kinda on you.

Anyway surely Instructure only stores user public keys or something?

Alternate history question: If they just sold the data, never revealed the hack, and didn't make a scene, from a customer perspective, how different would this be from business as usual?

copperx 56 days ago |

https://archive.is/5v693

xp84 56 days ago | |

What are we even coming to when even internet blogs are paywalled. Verge? Next thing Gizmodo is gonna be paywalled.

waltbosz 55 days ago |

For a more technical write up https://www.dataminr.com/resources/intel-brief/shinyhunters-...

I'm a software dev who was affected by the outage. I was working on an app that connects to the Canvas SAML endpoints. One minute I was able to run my code, the next I couldn't. This was a little after 17:00 EST.

krupan 56 days ago |

A college student I know just sent me a screenshot, he can't access canvas for his school at all

yesiamyourdad 56 days ago | |

Same, my daughter just sent a screenshot, she was trying to study for finals.

kristianp 56 days ago |

Qld, Australia was also affected: https://www.itnews.com.au/news/qld-gov-says-students-staff-c...

protocolture 56 days ago | |

QLD Government vendor selection is always terrible.

bigfatkitten 56 days ago |

I use Canvas for some postgraduate studies, and my teenage daughter uses it at her high school.

We already bond over how awful the Canvas UX is (and she has a bunch of Chrome extensions to improve it.) Now we’ve got something else to gripe over together.

auxiliarymoose 56 days ago | |

It is open source, so you could send pull requests with improvements: https://github.com/instructure/canvas-lms

scratchyone 56 days ago | | |

https://github.com/instructure/canvas-lms/pulls?q=is%3Apr+is...

haha i went to go check and they haven't merged a PR since 2017

copperx 56 days ago | |

I vibecoded a pretty extensive CLI for Canvas and using it is very pleasant. Joyful, even, when combined with an LLM. Especially when compared to the developer hostile Blackboard Ultra.

j027 56 days ago | |

Canvas seems like it’s not that great. But if you then use Blackboard Ultra it makes canvas look amazing.

bagels 56 days ago |

It's been a long time since I was in school. What does this software do?

mbreese 56 days ago | |

It is how classes (even in person ones) are organized. Assignments, quizzes, links to online textbooks, discussion boards, student/teacher messaging, student group messaging, etc. From the teacher side, I'm not sure if there is a backup copy for things like grades outside of Canvas. It's that pervasive.

Everything from middle school up to grad school.

It's a particularly interesting time to have this happen too -- many finals going on now.

windows_hater_7 56 days ago | |

It’s a “learning management system.” It replaces a course website in most instances. It’s also used for course grades and you can submit assignments or take quizzes.

Jtsummers 56 days ago | |

Grades, lessons, quizzes, exams, homework submission, rosters, messaging platform. Lots of things.

adampunk 56 days ago | |

If you’re a student or teacher: nearly everything that matters. Homework, materials, lectures, grades. It’s all on canvas.

kzrdude 55 days ago | | |

For my uni: mostly only lecture notes and materials.

rosie54 56 days ago |

Tbh this is extremely annoying for high school/college students too. High schools are in the middle of AP tests, and many universities have yet to finalize grades, so overall this is a terrible time for this to happen. After the first issue a few weeks ago Canvas should have upped their security and prepared for another attack. They also should provide better communication. If Canvas is down for more than a few days, many schools and universities will have a lot of trouble when it comes time to publish course grades.

acomjean 56 days ago |

I used canvas for some Harvard extension classes 10 to 5ish years ago. It worked Ok. Work distributed, grades posted. I didn't realized so many schools used it, or that it was all schools on one instance, which seems kind of nuts.

I lost access when I left as it was tied to my work email. I downloaded a lot, but there was still some useful stuff on the boards.

I wonder what the havkers found out about me. Perhaps the class notes will be lifted to train AI, higher quality than a lot thats on the internet anyway.

Gigachad 56 days ago | |

I discovered one of my old school assignments ended up on some homework help website. I had never posted this document publicly and had only uploaded it to the schools work submission page. Presumably at that point it was shared with multiple third parties for plagiarism checking and such. And then was exposed to a data breach years later and ended up on the public internet.

plasma_beam 56 days ago |

Our public school system here in Maryland got hit, ransom screen.

asdefghyk 55 days ago |

Hundreds of 1,000s of students affected by this hack in Australia ( and no doubt other countries around the world ...) Its more than the 10,000s Australian students mentioned in article below ...

https://www.abc.net.au/news/2026-05-08/students-lose-access-...

jshaqaw 55 days ago |

Shaking down schools with kids' data. Losers.

danso 56 days ago |

I wonder how much old data Canvas keeps around? Are students who graduated in 2016 going to be at risk of having their academic data leaked?

Fumblenuts 56 days ago | |

I bet it depends on the institution and the IT team behind said institution, but at least for my university we apparently don't delete old course shells or anything.

I'm friends with a professor who complained to me a couple times about how sometimes he will need to scroll through pages and pages of courses he taught in the past. He also mentioned that profs aren't able to delete their own course shells either.

Telaneo 56 days ago | |

It wouldn't surprise me if most of it is still around. The amounts of data are probably fairly small, and thus unless intentionally deleted, it's probably still there (maybe unis in Europe are more likely to bother to click the relevant buttons as to comply with the GDPR?). I can't imagine storage becoming an issue unless you've got a huge uni or classes that deal with video (and even then, those probably end up on Youtube as private videos, or only as really small clips).

spmartin823 56 days ago |

One thing I remember from my days in the LMS world is that obfuscated copies of prod tenants were used for testing. Almost every dev had at least one tenant from prod on their local computer. So with some de-obfuscation at least some of the data is plausibly retrievable. Whether that data is also public depends on how the negotiations go.

goryramsy 56 days ago |

Down for all students at my University… it’s going to be a headache for all professors to deal with extending due assignments.

eatmyshorts 56 days ago |

My daughter says that Northeastern is also affected. Is it more widespread? Did they infect all SaaS Canvas universities?

parable 56 days ago | |

Yes, all 8000+ institutions that use Canvas.

skeaker 56 days ago |

Pretty cruel to do this right around finals.

kelnos 56 days ago | |

That's exactly the point, I'm sure.

crazygringo 56 days ago | |

Even more incentive to pay up. I wonder if the timing was intentional or just coincidental.

enceladus06 56 days ago | | |

That is the point. Get an extra million or two $ in btc from Instructure.

ThrowawayR2 56 days ago |

I wonder when the public is going to start calling for corporate liability for malpractice in software development and corporate liability for malpractice in IT deployments. Even if the tech industry fights it, it probably won't be that much longer.

flashman 56 days ago |

What's in the files they've already released? Some of them are > 800GB.

HDBaseT 56 days ago | |

Where are you getting that information from?

I'm under the impression files are getting released 12th May. I don't see any reporting on 800GB?

DauntingPear7 56 days ago | |

Grades, records, etc I would assume. Someone else pointed out that they recently acquired https://www.parchment.com/ so they may have also been able to scoop up those records too

emmelaich 56 days ago | | |

Also discussions between students and teaching staff.

poopmonster 56 days ago | |

I'm guessing loads of student work? If so, it'll be great for anyone who wants to research AI usage in papers.

gigel82 56 days ago |

Damn, all schools in our district in Washington moved to Instructure last year.

They moved away from Teams because it objectively sucked, but I haven't heard of widespread compromises like this in Microsoft's systems so...

ghqst 56 days ago | |

Well instructure is slightly better than the somehow legal torture of having to use the "product" Microsoft Teams

corvad 56 days ago |

Some instances seem to be recovering. I wonder if a ransom was paid.

somebudyelse 56 days ago | |

It looks like Instructure has been removed from the ShinyHunters website. Both the entry and the list of schools has been removed.

mensetmanusman 55 days ago |

It's interesting how delta-function-esque security issues are, which makes it nearly impossible for young organizations to properly risk asses.

podiki 56 days ago |

And grades are due in the next week or so for many of these (usually a quick deadline at the end of the semester due to graduation happening)...

enjo 56 days ago | |

My wife’s grades are due tomorrow. She was in the middle of finishing exams when it happened. She can’t even access the exams to grade by hand. Total mess.

SoftTalker 56 days ago | |

Graduation is just a ceremony. The actual credential award depends on whether you finished all your coursework and is not time-boxed by that event.

Of course if you can't complete your exams because of this, that's more of an issue!

jrm4 56 days ago |

Canvas shouldn't exist in its current form, and neither should have Blackboard.

It's always been as stupid as requiring that your chalkboard, chalk, chairs, bluebooks, pens, paper, gradebook etc etc all come from the same company.

I, for one, am very much looking forward to my IT Gov council meeting tomorrow.

owlboy 56 days ago |

I’m not surprised. Canvas kind of sucks. And their development is slow. And they are poor at communicating during mundane events.

stringfood 56 days ago | |

They're also apparently poor at communication during highly interesting events as well

vondur 56 days ago |

It looks like every CSU System is on the list (California State University). Surprised this hasn't hit the front page yet.

DaSHacka 56 days ago | |

Possibly because they haven't released the data yet?

I'm honestly surprised more people aren't talking about this.

stevenjgarner 55 days ago |

So all these top universities using Canvas as a core part of their infrastructure somewhat begs the question : why would a technology degree from them have any real value if they can't even have their infrastructure built and maintained by students themselves? If their education is really worth that much money, why can't they build their own infrastructure?

dopidopHN2 55 days ago | |

Have you look at student generated code ?

I mean, maybe it changed in the last 10 years. But I was a TA grading CS majors for a while. Their C capstone or what have you.

Some were decent but naively coded. Most were pile of shit half hazardly put together so it output what is needed to get passing grade.

But I agree with you in spirit!

alexalx666 55 days ago |

Respect to Canvas sales team, its like microsoft level platform lock-in into low sec infra

daledavies 56 days ago |

Eek I bet there are a few people at Instructure who won't be getting much sleep tonight!

Telaneo 56 days ago |

Great. More data gone astray. Given Canvas' handling of the situation, I doubt they're going to learn much.

The timing probably isn't a coincidence. Great time to stress out students and staff alike. Hopefully it doesn't affect them too much in the end, but I imagine it will.

nektro 56 days ago |

going after systems that affect students is beyond bad taste

incomplete 56 days ago |

i work tech at a university that's impacted by this. while it doesn't impact me directly, many many other staff and instructors i know are heavily affected by this outage. the students are absolutely outraged, mostly because the university hasn't been providing updates as quickly as they'd like, but since the staff/admin are waiting on word from instructure -- and there hasn't been a lot from them, it just generally sucks for all of us.

this is really, really, REALLY bad. it's not great that names/emails/etc will potentially be leaked, but also private messages between students and instructors. and since many of the campus systems rely on canvas integration, things have pretty much ground to a halt a week before finals.

after they were breached on the 1st of this month, instructure had an announcement yesterday that "everything is great! we're good! hackers are gone! we've rotated our keys!".

no. nothing is great. we are not good.

thatxliner 56 days ago |

I remember this group did something else a while back too.

kelvinjps10 55 days ago |

At the beginning I thought it was the design tool

echelon 55 days ago |

> ShinyHunters

Is that a Pokemon reference?

mobeigi 55 days ago | |

I enjoyed the reference more than the story itself :)

tabarnacle 55 days ago | |

Yes

0xbadcafebee 56 days ago |

Nothing to see here folks. Just another predicable data breach from allowing companies to do whatever the hell they want with sensitive personal information.

This will keep happening, more and more, and never stop, until we create a software building code and legally require it for all online businesses.

Universities, Parents: ya'll actually have the political and economic power to get a software building code passed. This incident isn't the last.

SilverElfin 56 days ago |

Terrible that this affects children and that their information may be ultimately leaked. They need to be greater consequences in the law for security breaches.

ahdorman 52 days ago |

hopefully I don't get kidnapped idk

wg0 56 days ago |

You learn all the technical details only to harm people like that instead of making a modest and honest living.

Shame on your existence basically.

lazystar 55 days ago |

> Earlier in October, an Amazon Web Services incident resulted in Canvas and Piazza outages that lasted around 12 hours.

...what does that DDB DNS issue have to do with anything?

ahdorman 52 days ago |

I loki don't care about the canvas hack because it only has a LITTLE bit of my information¯\_(ツ)_/¯

stevenjgarner 55 days ago |

No paywall : https://archive.ph/fLR71

ahdorman 52 days ago |

vinni2 56 days ago |

I hate Canvas. I would rather run a course on GitHub. But our university forces it on us. And now this.

crazygringo 56 days ago | |

Do you remember how Canvas was a gigantic improvement over Blackboard?

And GitHub doesn't provide a way to record grades that remain private per student last I checked, much less sync them to the university, or 99% of other things Canvas does.

I don't love Canvas, but it's far, far preferable to a world without it.

poopmonster 56 days ago | | |

It is really convenient and stays out of the way. As much as I'm enjoying the mess, I am forced to appreciate its value.

bombcar 56 days ago | | |

> remain private per student last I checked

last I checked it appears grades remain private per planet or so ...

bombcar 56 days ago | |

How does Canvas compare to things like Moodle?

Or is it an entirely different class of beast?

wmoxam 56 days ago | | |

I've written a bunch of LMS integrations so I've had the opportunity to use all of the major LMSs. Basically, all LMS systems are rather user unfriendly and complicated with a ton of customization options hidden under layers of sub-menus/configuration settings. At their core they provide a grade book, student management tools, and some basic CMS type functionality for posting class messages/coursework/etc. They've all adopted a standard for interacting with external tools (LTI).

Canvas generally is the 'easiest' to use, and the 'cleanest' looking one although D2L Brightspace is pretty good too. Moodle out of the box is pretty confusing and ugly, but I've seen some heavily customized instances that look a lot better. Blackboard is the worst of the bunch IMO.

frollogaston 56 days ago | | |

Wow, I last used Moodle in 7th grade, 2008. It seemed like a similar thing.

ahdorman 52 days ago |

ewnwehiu

ahdorman 52 days ago |

swatson741 56 days ago |

I saw this happen to my Canvas account today. At first I thought it was a prank from the school or Instructure. The message was sent to students which makes no sense. Second, the message that was sent basically implies that ShinyHunter is actively getting patched out, and no one is ever going to give into their demands. They're basically saying that they're done and desperate. It's a strange message for ShinyHunter to send, but I think they were trying to pull off a psyop / FUD.

Looking into the payload they sent me this is how they hijacked the screen. Everything in the payload is unchanged except for one line of code:

This links to the following styling sheet:

@import url('https://fonts.googleapis.com/css2?family=Orbitron:wght@500;7...');

html, body { height: 100% !important; overflow: hidden !important; margin: 0 !important; padding: 0 !important; }

body > * { display: none !important; }

body { display: flex !important; align-items: center !important; justify-content: center !important; background: #07080c !important; }

body::before { content: "" !important; position: fixed !important; inset: 0 !important; z-index: 999998 !important; background: radial-gradient(ellipse at 50% 20%, rgba(255,59,59,.06), transparent 55%), radial-gradient(ellipse at 50% 85%, rgba(125,70,152,.04), transparent 45%), repeating-linear-gradient(0deg, rgba(255,255,255,.035), rgba(255,255,255,.035) 1px, transparent 1px, transparent 3px), #07080c !important; pointer-events: none !important; }

body::after { content: "\A\A" "S H I N Y H U N T E R S" "\A" "rooting your systems since '19 ;)" "\A\A\A" "ShinyHunters has breached Instructure (again)." "\A" "Instead of contacting us to resolve it they" "\A" "ignored us and did some \201Csecurity patches\201D." "\A\A" "\26A0 W A R N I N G" "\A\A" "If any of the schools in the affected list are" "\A" "interested in preventing the release of their" "\A" "data, please consult with a cyber advisory firm" "\A" "and contact us privately at TOX to negotiate a" "\A" "settlement. You have till the end of the day by" "\A" "12 May 2026 before everything is leaked." "\A\A" "Instructure still has until EOD 12 May 2026" "\A" "to contact us." "\A\A" " \25BC DOWNLOAD AFFECTED_SCHOOLS.TXT \25BC" "\A" "91.215.85.103/pay_or_leak/" "\A" "instructure_affected_schools_list.txt" "\A\A" "visit us: shnyhntww34phqoa6dcgnvps2yu7dlwzmy5" "\A" "lkvejwjdo6z7bmgshzayd.onion" !important;

    position: fixed !important;
    z-index: 999999 !important;
    top: 50% !important;
    left: 50% !important;
    transform: translate(-50%, -50%) !important;
    white-space: pre !important;
    text-align: center !important;
    font-family: 'Fira Code', 'Share Tech Mono', monospace !important;
    font-size: clamp(10px, 1.4vw, 14px) !important;
    line-height: 1.55 !important;
    color: #c8dce8 !important;
    background:
        linear-gradient(180deg, rgba(255,255,255,.05) 0%, rgba(255,255,255,.01) 3.2%, transparent 3.2%) !important;
    background-color: #0d0f16 !important;
    border: 2px solid #ff3b3b !important;
    border-radius: 14px !important;
    padding: 16px 32px !important;
    overflow: hidden !important;
    box-shadow:
        0 0 35px rgba(255,59,59,.2),
        0 40px 90px rgba(0,0,0,.65),
        inset 0 0 0 1px rgba(255,255,255,.06),
        inset 0 0 50px rgba(255,59,59,.03) !important;
    animation: pulseWarn 2.5s infinite ease-in-out !important;
    max-width: 94vw !important;
    text-shadow: 0 0 6px rgba(200,220,232,.15) !important;

}

@keyframes pulseWarn { 0% { box-shadow: 0 0 20px rgba(255,59,59,.15), 0 40px 90px rgba(0,0,0,.65), inset 0 0 0 1px rgba(255,255,255,.06); } 50% { box-shadow: 0 0 55px rgba(255,59,59,.4), 0 40px 90px rgba(0,0,0,.65), inset 0 0 0 1px rgba(255,255,255,.06); } 100% { box-shadow: 0 0 20px rgba(255,59,59,.15), 0 40px 90px rgba(0,0,0,.65), inset 0 0 0 1px rgba(255,255,255,.06); } }

The hack is crude, and it seems unlikely that they have any access to Instructure's developer tools.

aaronsung 56 days ago |

At the same time, Aussie tech giant pauses work, devotes entire week to AI Design software giant Canva has halted normal operations across its 5300-strong global workforce for five days of nothing but AI learning and hackathons, bucking the global wave of technology giants that have slashed jobs, citing the technology. https://www.smh.com.au/technology/aussie-tech-giant-pauses-w...

Torn 56 days ago | |

Canvas is not Canva. Is this a bot reply

[...] ;; ANSWER SECTION: canvas.ucdavis.edu. 1974 IN CNAME ucdavis-vanity.instructure.com. ucdavis-vanity.instructure.com. 60 IN A 18.173.121.125 ucdavis-vanity.instructure.com. 60 IN A 18.173.121.103 ucdavis-vanity.instructure.com. 60 IN A 18.173.121.15 ucdavis-vanity.instructure.com. 60 IN A 18.173.121.18

;; ANSWER SECTION: canvas.duke.edu. 300 IN CNAME duke-vanity.instructure.com. duke-vanity.instructure.com. 60 IN A 18.173.121.125 duke-vanity.instructure.com. 60 IN A 18.173.121.18 duke-vanity.instructure.com. 60 IN A 18.173.121.103 duke-vanity.instructure.com. 60 IN A 18.173.121.15