Massive Canvas Data Breach Disrupts Education: Ransom Demand Hits Millions of Students and Faculty

Overview of the Incident

An ongoing cyber extortion attack targeting Canvas, the widely used educational technology platform, has caused widespread disruption across school districts and universities in the United States. The breach, carried out by the cybercrime group ShinyHunters, replaced the Canvas login page with a ransom demand threatening to leak data from an estimated 275 million students and faculty across nearly 9,000 educational institutions.

Massive Canvas Data Breach Disrupts Education: Ransom Demand Hits Millions of Students and Faculty — Source: krebsonsecurity.com

Canvas, owned by Instructure, is a learning management system (LMS) that helps manage coursework, assignments, and communication. The attack forced Instructure to temporarily disable the platform, triggering outages during a critical period for many schools—the final exam season.

Timeline of Events

Initial Breach and Acknowledgment

Earlier this week, Instructure acknowledged a data breach after ShinyHunters claimed responsibility. The group initially set a payment deadline of May 6, later extended to May 12. In a statement on May 6, Instructure confirmed that the stolen data included "certain identifying information of users at affected institutions, such as names, email addresses, and student ID numbers, as well as messages among users." The company emphasized that no evidence of passwords, dates of birth, government identifiers, or financial information had been found.

Ransom Demand Disrupts Service

Despite Instructure's initial assertion that the incident was contained and Canvas was fully operational, on May 7, students and faculty reported seeing a ransom demand from ShinyHunters on the Canvas login page. Screenshots circulated on social media showed the extortion message, prompting Instructure to take Canvas offline. The platform was replaced with a notice stating, "Canvas is currently undergoing scheduled maintenance. Check back soon." The company's status page currently reads, "We anticipate being up soon, and will provide updates as soon as possible."

What Data Was Stolen?

According to Instructure's investigation, the compromised data includes:

Names and email addresses
Student ID numbers
Messages exchanged between users

ShinyHunters claims the breach is far larger, alleging they possess several billion private messages among students and teachers, as well as phone numbers and email addresses. However, Instructure has not confirmed these claims. The company assures that more sensitive data such as passwords, dates of birth, Social Security numbers, or financial records were not compromised.

Impact on Schools and Colleges

The timing of the attack has been particularly damaging. Many educational institutions are conducting final exams, and the prolonged outage has hindered students from submitting assignments and communicating with instructors. Social media platforms were flooded with complaints from affected users. The extortion message displayed on the login page advised schools to negotiate their own ransom payments directly with ShinyHunters, regardless of whether Instructure pays the ransom.

This approach could increase pressure on individual institutions, many of which lack dedicated cybersecurity resources. The potential leak of private messages also raises privacy concerns for millions of users.

Instructure's Response and Next Steps

Instructure has pulled Canvas offline to contain the defacement and is working to restore normal operations. The company has not yet announced a timeline for full restoration. In its May 6 update, Instructure stated, "We believe the incident has been contained," but the subsequent defacement suggests that the security breach may be more severe than initially thought.

The company continues to collaborate with law enforcement and cybersecurity experts to investigate the attack. Affected institutions have been advised to monitor accounts for suspicious activity and to consider enabling multi-factor authentication where available.

What's Next for Education Technology Security?

This breach underscores the vulnerability of centralized education platforms that store vast amounts of personal and academic data. As cyberattacks on the education sector rise, schools and universities must adopt stronger security measures, including encryption, regular security audits, and incident response plans. For now, students and faculty are left waiting for Instructure to restore full access to Canvas while hoping that their data remains protected.