A ransomware attack on the Canvas learning-management platform locked out millions of users and exposed hundreds of millions of records [1].

This breach disrupts the primary digital infrastructure for thousands of educational institutions, placing the sensitive personal data of students and faculty at risk of exploitation.

The lockout began on May 7, 2026 [2], affecting universities and colleges across the U.S. and Canada [3]. The hacker group ShinyHunters claimed responsibility for the attack, demanding a ransom and threatening to sell or release stolen data [4].

Reports indicate that over 275 million student and faculty records may have been compromised [5]. The scale of the breach impacted millions of students who were unable to access their coursework and academic materials [1].

Instructure, the parent company of Canvas, negotiated with the attackers to resolve the crisis. While some reports state a deal was reached to ensure the hackers delete the stolen data [4], other sources said the company paid the ransom [5]. The exact amount of any payment was not disclosed.

Following the incident, the U.S. Congress called the CEO of Instructure to testify as part of an investigation into the breach [3]. The investigation seeks to determine how the security failure occurred and why the platform's defenses were unable to prevent the lockout.

“Over 275 million student and faculty records may have been compromised”

The scale of this breach underscores the vulnerability of centralized educational software. By targeting a single platform used by thousands of institutions, attackers can create massive leverage, forcing companies to choose between paying ransoms or facing global academic paralysis and the leak of millions of records belonging to minors and adults.