The Canvas learning-management system was offline Thursday during a cyberattack, leaving students at many schools and universities unable to access grades, course notes, assignments, and lecture materials as final exams and other end-of-semester activities approached, according to a threat analyst and messages sent by multiple campuses.
Luke Connolly, a threat analyst at the cybersecurity firm Emisoft, said the hacking group ShinyHunters claimed responsibility for the Canvas breach. Instructure, the company behind Canvas, did not immediately respond to requests for comment about whether the platform was taken down as a precaution or whether the hackers knocked it offline.
Connolly said ShinyHunters posted online that nearly 9,000 schools worldwide were affected and that the group accessed “billions of private messages and other records.” Students quickly turned to social media to ask whether Canvas access problems were affecting other campuses as they tried to study for finals using materials hosted on the platform.
Connolly also said he was shown screenshots in which the group began threatening as early as Sunday to leak a trove of data, setting a deadline of Thursday and another deadline of May 12. He said the later date suggested discussions regarding extortion payments may still be ongoing.
As the disruption spread, universities and districts warned students and parents and began offering alternative steps for coursework. The University of Iowa’s College of Public Health director of information technology wrote that the school’s online system was down and described it as “being reported as a national-level cyber-security incident,” while saying “Hopefully we will have a resolution soon.”
Virginia Tech acknowledged the impact on final exams and other end-of-semester activities in a notice to students. The University of New Mexico sent a similar message to its campus community, and the University of Florida urged students to stay alert for phishing messages that appear to be from Canvas.
Teachers and students reported needing workarounds as they prepared for exams and submitted final assignments. Damon Linker, a senior lecturer in the political science department at the University of Pennsylvania, said his students had been relying on Canvas to access every reading from the semester and his lecture slides before their Monday final exams, describing the situation as leaving students and faculty “dead in the water here in academia right now.”
Other campuses reported different levels of trouble. The Harvard student newspaper reported that the system there was down as well. Johns Hopkins University students received an error message when trying to view final grades on the platform Thursday. In Spokane, Washington, public school officials told parents they were not aware of any sensitive data contained in the breach, according to the report.
Some institutions responded by adjusting exam schedules. The University of Texas at San Antonio announced it would push back finals scheduled for Friday, reflecting how quickly educators had to adapt as Canvas remained unavailable.