Imagine logging into your online classroom only to find the doors locked—and a ransom note demanding payment before you can get back in. That nightmare is now reality for millions of students and faculty across the United States, as Canvas, the dominant learning management system used by over 8,000 colleges and universities, has been hacked.
A notorious group calling themselves ShinyHunters has claimed responsibility, and they’ve given Instructure, Canvas’s parent company, a chilling ultimatum: pay up by May 12, or watch everything leak into the public domain. The clock is ticking, and the stakes couldn’t be higher.
Reports of Canvas outages have exploded nationwide. In the span of just thirty minutes, complaints of students locked out of their courses, assignments, and gradebooks surged from nearly zero to thousands. Campuses from coast to coast are scrambling.
This isn’t ShinyHunters’ first strike against Instructure. In a previous breach just weeks ago, the group made off with names, email addresses, student ID numbers, and private messages exchanged between users. Instructure claimed there was no evidence that passwords, birthdates, social security numbers, or financial details were stolen—but the damage was already deep.
The hackers didn’t stop there. They taunted Instructure by referencing the company’s own security patches, posted on May 2, in a brazen message left for Canvas users. It was a warning: we’re still inside. And we’re not done.
ShinyHunters boasted that their earlier heist totaled over three terabytes of data, affecting 275 million people across nearly 9,000 educational institutions. If this second wave matches that scale, it could be one of the largest digital assaults on education in history.
While the ransom deadline looms, there are immediate steps you can take to protect yourself. First, change your Canvas password immediately—and if you use that same password anywhere else, change those too. Second, enable multi-factor authentication (MFA) for an extra layer of defense.
Be on high alert for phishing emails. Hackers now have your email address and possibly your student ID—they can craft messages that look terrifyingly legitimate. Never install software or share account details based on an unsolicited email.
Finally, monitor your credit reports. Even though Instructure hasn’t confirmed financial data was taken, a cautious check now could save you from identity theft later. The classroom may feel unsafe today, but you can still lock down your digital life.
