Canvas Hack Hits Universities As ShinyHunters Turns Classrooms Into A Data Breach Story

Instructure’s Canvas, a widely used education platform for grades, coursework, and student communication, was disrupted after hacker group ShinyHunters claimed it had breached the company and accessed student-linked data across thousands of schools.
 

TL;DR

 

• Canvas was placed in maintenance mode after users reported login issues and breach claims surfaced across university portals
• ShinyHunters claimed responsibility and alleged that close to 9,000 schools worldwide were affected
• The group also claimed data linked to 275 million people was involved, though those figures remain unverified
• Instructure confirmed that some personal data was compromised, including names, email addresses, student ID numbers, and private messages
• Instructure later marked the incident as resolved and recommended customers enforce MFA, review admin access, and rotate API tokens or keys where applicable

 

Canvas Cyberattack Disrupts Access For Students Across Universities

Canvas, the online learning platform used by schools, colleges, and universities for grades, class materials, assignments, and student communication, faced a major disruption after reports from multiple college newspapers said students were blocked from accessing the service.

The incident first gained wider attention after The Harvard Crimson reported that students could not access Canvas beginning Thursday afternoon. The publication also reported that ShinyHunters claimed Harvard was among thousands of schools allegedly affected by a breach of Instructure, Canvas’ parent company.

According to student newspaper reports, Canvas users were redirected to a message from ShinyHunters, in which the group claimed responsibility and posted a list of schools it said were breached.

 

Instructure Puts Canvas In Maintenance Mode And Later Marks Incident Resolved

As the disruption unfolded, Instructure said Canvas and related sites had been placed “in maintenance mode” while it investigated login issues affecting some users of Student ePortfolios.

The company said at the time, “We anticipate being up soon, and will provide updates as soon as possible.”

Having begun investigating on May 01, Instructure provided users with two updates on May 02 and May 06, before finally declaring the incident as Resolved on May 06.

On its official incidents status webpage, Instructure said:
 

 

ShinyHunters Claims Massive Canvas Data Theft, But Numbers Remain Unverified

ShinyHunters claimed the breach affected close to 9,000 schools worldwide and 275 million people, including students, teachers, and staff. A member of the group also claimed that the stolen data contained 231 million unique email addresses.

However, financially motivated hacking groups are known to exaggerate breach claims to pressure victims and attract attention.

Instructure confirmed that personal data was compromised, including names, email addresses, student ID numbers, and private messages between students and instructors. Passwords and financial data were reportedly not stolen.

TechCrunch reported that a sample shared by ShinyHunters included data from two U.S. schools, one in Massachusetts and one in Tennessee. The sample included names, email addresses, some phone numbers, and messages in one case, but it did not include passwords.
   

Universities In The US And Netherlands Respond To Canvas Breach Fallout

The impact was not limited to one campus. Student newspapers from Duke University, UCLA, the University of Nebraska, the University of Pennsylvania, and others reported that their institutions had been affected.

The Daily Pennsylvanian reported that ShinyHunters posted a message on Penn’s Canvas page last week, warning universities to contact the group before May 12 if they did not want their data released.

In the Netherlands, Vrije Universiteit Amsterdam disconnected all systems linked to Canvas as a precautionary measure and reported the incident to the Dutch Data Protection Authority. Universities of the Netherlands said seven Dutch universities were affected, including the University of Amsterdam, Erasmus University Rotterdam, Tilburg University, Eindhoven University of Technology, Maastricht University, and the University of Twente.

Instructure said it implemented security patches, increased monitoring, and rotated application keys. Customers must reauthorize API access, while the investigation continues.