technology
Canvas Online Platform Restored After Data Breach Affecting Schools
The online education platform Canvas was taken offline on Thursday following a data breach claimed by the ShinyHunters group. Instructure, the platform's parent company, confirmed the incident involved names, email addresses, student IDs and messages but no passwords or financial data. Many schools delayed final exams and advised users not to log in immediately while they review security.
May 8, 2:09 PM·3m read2 sources
NprAudio version
Tap play to generate a narrated version.
Developing·Limited corroboration so far. This page will refresh as more sources emerge.
The online education platform Canvas was restored to service on Thursday after it was taken offline due to a data breach. Instructure, the company that operates Canvas, said the platform is now fully back online and available for use. The outage occurred during the final exam period for many schools.
Instructure confirmed a series of cybersecurity incidents this week. The company said it first detected unauthorized activity in Canvas on April 29. It took the platform offline on Thursday after the actor made changes that appeared for some logged-in users.
The breach affected identifying information including names, email addresses, student ID numbers and user messages. No passwords, birth dates, government identifiers or financial information were involved, according to Instructure. The company temporarily shut down Free-for-Teacher accounts that the actor had exploited.
Thirty million users rely on Canvas, including at half of all higher education institutions in North America. The platform is used to manage courses, submit assignments, view grades and handle communication. Schools in the K-12 system were also affected.
A group known as ShinyHunters claimed responsibility for the breach. The group said an initial breach on Saturday involved data including private messages from 275 million students, teachers and staff at nearly 9,000 schools worldwide. ShinyHunters had previously taken credit for a Ticketmaster data breach in 2024.
The group posted on a threat intelligence website that affected schools could prevent data release by consulting cyber advisory firms and negotiating settlements through the encrypted chat platform Tox. It set a deadline of the end of the day on May 12, 2026 before material would be leaked.
