technology
Canvas Hack Disrupts Online Learning at California Colleges
A hack of the Canvas education platform on May 7, 2026 affected more than 1 million California university students during midterm and final exam periods. The outage disrupted access to assignments, tests, course materials and instructor communications at UC, Cal State and community college campuses. Instructure, the company that operates Canvas, said core learning data was not compromised.
May 11, 7:40 PM·3m read1 source
CalMattersAudio version
Tap play to generate a narrated version.
Developing·Limited corroboration so far. This page will refresh as more sources emerge.
A hack of the Canvas education platform disrupted access for more than 1 million California higher education students beginning May 7, 2026. The outage occurred as many University of California students prepared for midterms or final exams. Esther Mejia and Kelly Merchant, public policy students at UC Riverside, said they could not reach several professors for guidance after losing access to assignments, tests and required reading material.
Mejia said in an interview that this was a crucial time for students to access coursework and that professors should have reached out. Merchant learned of the hack on Reddit after being logged out while finishing an assignment. By Friday she had heard from only one professor, who created a Discord group earlier in the term and used it to share material for an assignment due the next day.
The attack appears to have begun on or around April 29 when Instructure detected unusual activity, according to a class-action suit filed in a Texas federal court. The company later disclosed that the breach exploited a vulnerability in Canvas’s free tool for teachers.
On May 4 some California State University campuses experienced a brief shutdown but returned to operation within 20 to 30 minutes. By May 7 the platform went offline across multiple systems. The University of California blocked access that day and stated on its website that Canvas would not be restored until the system was confirmed secure.
The hacker group ShinyHunters claimed to have obtained sensitive data including billions of messages and threatened to release it unless paid a ransom. Instructure’s CEO said core learning data such as course content, submissions and credentials was not compromised.
