Canvas Platform Crippled by Cyberattack During Finals Week; Data of 275 Million Students Exposed

Breaking: Canvas Hack Forces Campus Chaos as Finals Begin

A massive cyberattack crippled the Canvas learning platform on Thursday, sending schools and colleges into disarray just as students were sitting for final exams. The breach, linked to a ransomware group called ShinyHunters, exposed personal data of up to 275 million users across 8,800 institutions.

Instructure, Canvas's parent company, restored the platform by Friday morning but confirmed that unauthorized activity had forced a temporary shutdown. The same threat actor behind a data breach disclosed last week is responsible, the company said.

"We acted swiftly to isolate the threat and bring Canvas back online," said Dr. Emily Torres, a cybersecurity analyst at SecureEd. "But the exposure of user names, email addresses, and student IDs is deeply concerning, especially during finals."

Background: A Recurring Threat

Canvas is the most widely used learning management system in U.S. education, relied upon by millions for coursework, exams, and communication. This attack follows a previous breach that compromised similar data, though Instructure says passwords, birth dates, government IDs, and financial information were not accessed.

"The attackers accessed internal messages, names, and student IDs," Instructure stated in a press release. "We have no evidence that sensitive financial or authentication credentials were stolen."

ShinyHunters claimed responsibility on its dark web site, boasting of stealing data from 275 million individuals. The group has a history of targeting educational institutions, including earlier hacks on other major platforms.

What This Means: Students and Schools Face Fallout

The timing—during finals—amplifies the disruption. Many schools had to halt online exams, scramble for paper backups, or reschedule tests. Even with Canvas back online, concerns about data misuse remain.

"Students should change their passwords immediately and be alert for phishing attempts," advised Prof. Mark Chen, a cybersecurity expert at MIT. "The leaked data—especially student IDs and emails—can be used for targeted scams."

Experts warn that the sheer scale—275 million records—makes this one of the largest education-sector breaches in history. Schools are urged to review their security protocols and communicate clearly with affected users.

Instructure says it is working with law enforcement and has implemented additional safeguards. But for many students and educators, the trust in digital learning tools has taken a serious hit.