University of British Columbia

Summary

A cyber attack claimed by the group ShinyHunters disrupted the Canvas learning management system owned by Instructure, affecting thousands of educational institutions worldwide. The University of British Columbia notified students that Canvas was unavailable due to the breach and advised them to log out immediately. The outage prompted several universities to postpone or cancel exams and to warn students against attempting to log in while services were restored. Instructure reported that the platform was available for most users but some institutions continued to experience disruptions.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On May 8 2026 a cyber attack attributed to the hacking group ShinyHunters disrupted the Canvas learning management system owned by Instructure, affecting an estimated nine thousand universities and schools across the globe. The group claimed responsibility for the breach and sent ransom notes demanding negotiation to prevent the release of data. Instructure reported that Canvas was available for most users but many institutions continued to experience outages. The University of British Columbia in Vancouver issued a notice to students stating that Canvas was unavailable due to a cyber breach of its parent company Instructure and advised them to log out immediately.

The University of Sydney told students that Canvas was unavailable and instructed them not to attempt to log in. Mississippi State University postponed its Friday final exams to allow affected students to recover any lost work. Idaho State University cancelled exams scheduled after 12:00 local time on Thursday. Penn State University informed students that no one had access to Canvas, said a resolution was unlikely within the next twenty‑four hours and cancelled some exams for Thursday and Friday. The University of Toronto confirmed it was impacted and noted that multiple universities were affected. At the University of California Los Angeles students struggled to submit assignments through Canvas while the University of Chicago in Illinois temporarily disabled its Canvas page after reports it had been targeted. Northwestern University masters student Jacques Abou‑Rizk described receiving a link in an email that appeared to come from a university administrator, which displayed a threatening message from ShinyHunters demanding contact to negotiate a settlement and avoid data release; Northwestern responded with a generic email saying it was monitoring the issue and had no estimated restoration time for Canvas, and Abou‑Rizk reported he remained unable to access Canvas on Friday and had not heard further from the university.

Screenshots showed the threatening messages began on Sunday with deadlines set for Thursday and 12 May, according to Luke Connolly a threat analyst at Emisoft who told the Associated Press that discussions regarding extortion payments could be ongoing. On the same day as the attacks Senator Chuck Schumer sent a letter to the Trump administration urging stronger defenses against cyber risks in the age of rapidly developing AI and wrote that the Department of Homeland Security must immediately help states and localities to prevent outages that could put lives and livelihoods at risk. The BBC sought comment from Northwestern University and invited readers to share their experiences.

Sources

Sources available to members: 1 source.