School app Canvas breach hits during finals

Instructure’s Canvas platform, widely used by K-12 schools, colleges, and universities, suffered a cybersecurity breach on April 29, 2026. The company detected unauthorized activity and revoked access, later identifying further tampering on May 7, including changes to user pages. As a precaution, Instructure temporarily shut down Canvas to investigate and apply safeguards, confirming the breach exploited its Free-For-Teacher accounts. The hacking group ShinyHunters claimed responsibility, threatening to leak data from nearly 9,000 schools and 275 million individuals unless contacted by May 12, 2026. Instructure has not verified these claims but acknowledged the incident’s severity, stating it disabled Free-For-Teacher accounts to restore secure access. The platform was later brought back online. The outage disrupted finals week for students at schools like Harvard, the University of Pennsylvania, Duke, UCLA, and the University of Nebraska. Users reported being blocked from accessing assignments, grades, and exam details, exacerbating stress during critical academic periods. Instructure’s statement emphasized the immediate response, including forensic investigations and collaboration with external experts. The company expressed regret for the inconvenience and assured users that security measures were strengthened before restoring full access. The incident highlights vulnerabilities in educational technology systems, where disruptions can have widespread academic and administrative consequences. Schools and students remain on alert as investigations continue.