Cyber Incident Victim: Idaho State University

On Sunday the hacking group ShinyHunters began a cyber campaign that targeted the Canvas learning management system owned by Instructure, claiming responsibility for the disruption and sending messages that urged affected institutions to negotiate a settlement to avoid the release of their data. By Thursday the attack had spread to an estimated 9,000 universities and schools across the United States, Canada, and Australia, with Instructure reporting that Canvas was “available for most users” while acknowledging that some institutions continued to experience outages on Friday. The University of Sydney told students that Canvas was unavailable and advised them not to attempt to log in, while Mississippi State University announced the postponement of Friday’s final exams to allow students to recover any lost work. Penn State University informed students that no one had access to Canvas and cancelled some exams scheduled for Thursday and Friday, and the University of British Columbia in Vancouver warned that Canvas was unavailable due to a cyber breach of its parent company Instructure, urging users to log out immediately. The University of Toronto confirmed it was impacted by the breach, noting that multiple universities were affected, and students at the University of California Los Angeles reported difficulties submitting assignments online through Canvas. The University of Chicago in Illinois temporarily disabled its Canvas page after reports that it had been targeted, and Northwestern University masters student Jacques Abou‑Rizk described receiving a ransom‑style message from ShinyHunters after clicking a link that appeared to come from a university administrator, leaving him unable to access Canvas on Friday and uncertain about what data might be released. Idaho State University joined the list of affected institutions by announcing on Thursday that it had cancelled all exams scheduled after 12:00 local time (18:00 GMT), stating that it was still waiting for advice from Instructure regarding the outage and the restoration of service.

The disruption caused widespread chaos during the high‑stakes end‑of‑year academic period, interfering with coursework, examinations, and the ability of students to submit work or access learning materials. Universities communicated with their communities through website announcements and email updates, often noting that they lacked an estimated restoration time for Canvas and confirming that other IT infrastructure had not been affected. Instructure’s updates indicated that while most users regained access, a subset of institutions continued to report problems on Friday, prompting ongoing discussions about possible extortion payments as threat analysts observed that the group had set deadlines for Thursday and May 12. In response to the escalating threat, Senator Chuck Schumer urged the Trump administration to have the Department of Homeland Security immediately assist states and localities in defending against cyber risks, emphasizing the need to prevent further outages that could endanger lives and livelihoods. The incident highlighted the vulnerability of widely used educational platforms to coordinated cyber attacks and the cascading effects such disruptions can have on academic schedules and student anxiety across multiple countries.