Hackers Claim Canvas Breach Affecting Thousands of Schools During Finals

Students at colleges and school districts across the country found Canvas, the online learning platform they use for assignments, quizzes and exams, replaced by a message from a hacking group on Thursday, as the group claimed to have stolen data on millions of users. The platform is run by the education software company Instructure and is used by thousands of schools, CBS Sacramento reported.

The group, which calls itself ShinyHunters, said on its page that it had breached Instructure “again,” TRT World reported, and claimed to hold 280 million student and staff records from 8,809 colleges, school districts and online education platforms. Those figures are the hackers’ claims and are unverified. Education Week, citing the Associated Press, reported that the group says it accessed information from about 9,000 schools worldwide, and CBS Sacramento said the breach may affect as many as 9,000 schools. Education Week said it could not confirm the group’s demands.

At Sacramento State, students who logged in Thursday were redirected to a page with the group’s message threatening to leak stolen data unless a ransom is paid, CBS Sacramento reported. The group gave Instructure until May 12. TRT World reported that it also urged schools to hire a cyber advisory firm and contact the group privately to negotiate. Universities that issued statements to students include Harvard, Stanford, Columbia, Rutgers, Princeton, Kent State and Georgetown, TRT World said, and Stanford said Canvas was unavailable because of a vendor issue.

Instructure says it first detected unauthorized activity on April 29. Education Week reported that the company said it has engaged outside forensic experts. The data likely accessed includes names, email addresses, student ID numbers and messages sent through Canvas, according to what Instructure told at least one district, as reported by Education Week; the company said there is no evidence yet that Social Security numbers, birth dates or financial information were compromised. Some school officials in California said there was no evidence that Social Security numbers, financial data or home addresses were exposed, CBS Sacramento reported.

The timing hurt. The attack came as many college students were preparing for finals and graduation, and Education Week reported that many K-12 schools also had disruptions after Canvas was taken offline. Orange County Public Schools in Florida disabled Canvas as a precaution and warned parents about scams, while Arlington Public Schools in Virginia and San Diego Unified in California were notified that they may have been affected.

Doug Levin, co-founder of the nonprofit K12 SIX, which helps schools defend against cyberattacks, told Education Week that it is “a substantial cyberattack that has echoes of the 2024 PowerSchool breach.” He said Instructure had not shared enough for people to judge its security, and that “the odds of experiencing an incident are quite high.” Education Week also noted that in the PowerSchool case the company paid a ransom for data deletion but the hacker later contacted districts to extort them, and stated that the Trump administration has cut its investment in K-12 cybersecurity while many state and local governments face budget shortfalls.

Sacramento State senior Michael Lee Chang told CBS Sacramento he was stressed and worried about his data. Instructure had not issued a direct public statement to that outlet when it reported.