James Madison University

Summary

A cyberattack on the Canvas learning management system compromised personal data including names, email addresses, student IDs and messages for thousands of educational institutions. The breach forced the platform offline and prompted a claim of responsibility from the hacking group ShinyHunters. In response, James Madison University revised its exam schedule to accommodate the disruption. Instructure later restored service after shutting down the vulnerable Free-For-Teacher accounts that were exploited.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

In late April 2026, Instructure detected unauthorized activity within its Canvas environment and immediately revoked the associated access. On Thursday, an unauthorized actor made changes to Canvas pages, prompting the company to take the learning platform offline. The shutdown exposed personal information such as names, email addresses, student IDs, and messages that appeared to have been breached. Students accessing the Harvard Canvas site on Thursday were redirected to a message from the hacking group ShinyHunters, which claimed responsibility for the breach and posted a list of affected schools. By Friday, Instructure reported that Canvas was back online and noted that the attackers had exploited a vulnerability in Free‑For‑Teacher accounts, which it subsequently disabled.

The Canvas outage occurred at a critical time for college students who were preparing for final examinations, forcing several institutions to adjust their assessment schedules. Penn State canceled its Thursday night and Friday exams, while Boise State canceled all Friday final exams. Mississippi State opted to reschedule its Friday exams to Saturday, and UT San Antonio postponed assignments and exams to a near‑future date. James Madison University, affected by the platform shutdown, pushed its Friday morning exams to Wednesday to accommodate the disruption.

Instructure’s response included revoking the unauthorized actor’s access, taking the site offline to contain the breach, restoring service on Friday, and disabling the Free‑For‑Teacher accounts that had been exploited. The company stated that, based on its investigation to date, there was no indication that passwords, dates of birth, government identifiers, or financial information had been compromised. Instructure also affirmed that no its customers would be extorted as a result of the incident. Separately, the University of Iowa announced it was seeking a cybersecurity partner to provide incident response and digital forensic services following the Canvas breach. These actions reflect the broader effort by affected institutions to address the security incident and mitigate its impacts.

Sources

Sources available to members: 2 sources.