Overview
- Canvas, which went offline Thursday for many users, locked students out of exams and course materials during finals.
- The criminal group ShinyHunters posted ransom notes on campus login pages and set a May 12 deadline to prevent data leaks.
- Instructure, the company behind Canvas, put the system in maintenance mode, engaged outside forensics, and said access was restored for most users by late Thursday.
- The company said exposed data appears limited to names, email addresses, student IDs and messages, with no evidence of password, birth date or financial data theft so far.
- Attackers claim data tied to nearly 9,000 institutions and hundreds of millions of users, a scale that remains unverified as schools and national cyber agencies assess risks and warn about phishing.