Hackers attack widely-used learning platform, disrupting schools nationwide
Hackers launched a ransomware attack Thursday against Canvas, the online learning platform used by thousands of colleges and K-12 schools across the country.
The cyberattack knocked the service offline for hours at a critical time in the academic year, with students preparing for finals and wrapping up classes.
Major universities, including Columbia, Princeton, Harvard and Georgetown, all reported outages. In some cases, a ransom note appeared directly on the school Canvas homepages.
By Thursday night, Instructure — the parent company of Canvas — announced the platform had been restored for most users. At that point, however, many institutions had adjusted finals schedules and extended deadlines.
What happened?
Much of the early information came from student-run news organizations, which reported students tried to log on and found a ransom note from the hacking group “ShinyHunters.”
The group reportedly threatened to leak sensitive data unless a ransom was paid by May 12. Canvas is widely used by schools to manage grades, coursework, assignments and internal communications.
It’s unclear whether the negotiations are ongoing or if the threat is active.
In the ransom message, ShinyHunters claimed it had targeted Canvas “again,” implying it had been done before, CNN reports. The group accused Instructure of ignoring earlier warnings. “Instead of contacting us to resolve it, they ignored us and did some ‘security patches.’”
Instructure disclosed a separate cyberattack on May 1, but said the breach was “contained.” It’s unclear if that attack was by ShinyHunters, but Instructure said students’ names, email addresses, student ID numbers and communications were exposed.
ShinyHunters also claimed responsibility for a 2024 Ticketmaster hack and threatened to sell user data on the dark web.
Which schools were impacted?
A full list of affected schools has not been released, but the disruptions stretched across major Ivy League universities, private universities like Creighton and Duke, and even public institutions such as the Universities of Pennsylvania, Illinois and Oklahoma.
K-12 districts were also hit. ShinyHunters claimed roughly 9,000 institutions were affected overall.
“The biggest cause of fear and anxiety in me is that I was deprived of significant resources to study and do the best,” University of Pennsylvania junior Anish Garimidi told CNN.
Round out your reading
- First, it was the schools. Now they’re coming for your cellphone at work.
- Why one of America’s top economic forecasters is worried about a recession.
- AI companies may not be adhering to their own guidelines — with potentially deadly outcomes.
- Data centers are a thorny issue for Democrats. Maine shows us why.
- We’re building a new Straight Arrow. Help us shape our future by taking our survey.
Ella Rae Greene, Editor In Chief
