Northwestern University

Summary

Northwestern University experienced disruption when the Canvas learning management system was taken offline in a global cyberattack attributed to the ShinyHunters group, which compromised data for approximately 275 million users across thousands of institutions. The breach exposed usernames, email addresses and enrollment information while Instructure worked with forensic experts, eventually paying the attackers to restore data and pledging no further extortion of its customers. The institution postponed exams and assignments while staff sought alternative teaching methods and worked to restore access by the weekend.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

In early May 2026 a cyberattack carried out by the ShinyHunters group targeted Instructure’s Free for Teacher environment, a low‑security support portal associated with the Canvas learning management system. The exploit allowed the attackers to access data linked to roughly 275 million users across more than 9,000 educational institutions worldwide, including Northwestern University, the University of Iowa, Iowa State University and the University of Illinois at Urbana‑Champaign. According to Instructure’s initial notification sent to affected institutions on May 5, the compromised data consisted of usernames, email addresses and enrollment information, while passwords, dates of birth, government identifiers and financial details were not found to be involved. The company later disclosed that it had paid the hackers to retrieve the stolen data and obtained digital confirmation of the return, accompanied by a promise that no Instructure customers would be extorted as a result of the incident. Instructure’s ISO 27001 certification remained current at the time, but the breach exposed gaps in the security of auxiliary services and was initially mischaracterized as scheduled maintenance, which delayed clear communication to customers.

The outage disrupted normal academic operations at many campuses. The University of Illinois at Urbana‑Champaign postponed all final exams and assignments after Canvas went offline, later extending the postponement to all classes while its Technology Services worked to restore a connection to the platform. Northwestern University officials issued an online message stating that they were working to reconnect to Canvas by Saturday morning, reflecting the institution’s reliance on the system for course materials, announcements and student communications. The University of Iowa reported that the breach prompted administrators to seek a new incident response and digital forensic services partner, issuing a request for qualifications that emphasized the need for rapid response to critical and high‑severity cybersecurity events. Iowa State disclosed that it had spent approximately $9 million with Instructure since adopting Canvas in June 2020, while the University of Iowa had paid Instructure $4.1 million over the previous decade and $451,588 in the 2026 budget year. These financial figures illustrate the scale of the institutions’ investments in the learning management system prior to the attack.

In response to the incident, the University of Iowa’s request for qualifications outlined a phased incident response framework that included initial triage, containment, investigation, eradication and recovery, and post‑incident debriefing, with a required initial response within four hours for critical and high‑severity events and 24‑hour coverage during active incidents. The University of Illinois Technology Services coordinated with campus leadership to assess whether Canvas could be safely restored for use by students, faculty and staff, and to develop alternate instructional plans if the platform remained unavailable. Northwestern’s officials continued their efforts to reestablish Canvas connectivity as part of the broader institutional response to the outage. Instructure maintained communication with affected institutions through email updates, provided confirmation of data retrieval, and reiterated its commitment not to extort customers. These actions represent the factual chronology, impacts and response measures documented in the available sources concerning the Canvas cyberattack and its effect on Northwestern University and other affected institutions.

Sources

Sources available to members: 4 sources.