Canvas Outage Disrupts Universities After Instructure Cybersecurity Incident
Summary
A cybersecurity incident at Canvas operator Instructure caused outages at universities nationwide. Stanford cited information indicating names, emails, student IDs and user messages were involved; ShinyHunters claimed responsibility, but Instructure has not confirmed it
Key points
- Universities across the US reported Canvas outages on Thursday, with Boston College confirming disruption and Harvard reporting the platform remained unavailable.
- Instructure’s chief information security officer reported a cybersecurity incident involving a “criminal threat actor” on May 1.
- Stanford said information from Instructure indicated the breach involved names, email addresses, student ID numbers and messages among users.
- Rutgers said it was unclear what school data may have been compromised.
- ShinyHunters claimed responsibility in a dark web post seen by Bloomberg News; Instructure has not confirmed the group was behind the incident.
- Baylor warned students about possible phishing messages from attackers impersonating school IT staff.
Article Details
- Victim Organization
- Instructure
- Incident Type
- Cybersecurity incident involving a reported data breach and disruption of the Canvas online learning platform.
- Disclosure Date
- 2026-05-01
- Data Types Exposed
- Names
- Email addresses
- Student ID numbers
- Messages among users
- Operational Impact
- Canvas was unavailable to users at universities across the United States, disrupting access to online learning. The article reports outages at multiple universities, including Boston College and Harvard.
- Ransom Or Extortion
- ShinyHunters claimed responsibility, but Instructure had not confirmed the group's involvement. The article reports no incident-specific ransom demand or extortion fee.
- Claim Status
- confirmed