FOLLOW US

A massive cyberattack targeting one of the world’s most widely used academic platforms threw universities and schools across the US, Canada, and Australia into turmoil this week, disrupting final exams, locking students out of coursework, and triggering fears over stolen data during one of the most critical moments of the academic year.

The hacking group "ShinyHunters" claimed responsibility for the sweeping attack on Canvas, the online learning platform owned by Instructure and used by thousands of schools globally. The breach sparked outages, ransom threats, and panic among students racing to complete exams and assignments before deadlines.

By late Thursday, Instructure said Canvas was "available for most users", though universities across several countries continued reporting disruptions into Friday.

The scale of the attack was staggering. Roughly 9,000 institutions were believed to be affected.

At Mississippi State University, officials postponed Friday’s final exams after students lost access to coursework and feared their submissions had vanished.

Aubrey Palmer, a meteorology student at the university, told the BBC students had just completed a grueling 2,900-word exam essay when their screens suddenly displayed a chilling ransom message.

"Shiny Hunters has breached Instructure (again)."

The message warned that stolen data would be released unless a bitcoin ransom was paid by Canvas or the affected universities.

"My knee-jerk reaction was that I'd been hacked myself, because that's what it looked like," Palmer said. "But then I actually read the ransom note and saw it was Canvas that had been hacked."

Palmer described a classroom filled with confusion and panic as students and professors realized they had all received the same message.

At first, nobody knew whether their work had been saved.

Then anger set in.

Palmer said students became "so angry at the idea of having to redo" their exams.

The university has since emailed students with updates, rescheduled tests, and urged students to avoid suspicious links and messages while responding to what it called a "nationwide security incident."

The disruption quickly spread across continents.

The University of Sydney warned students Friday that "Canvas was unavailable" and instructed them not to log in.

"We are one of approximately 9000 institutions around the world that are impacted by this outage, and we are still waiting for advice from Instructure," the university wrote online.

School officials acknowledged the outage hit at a devastating time, saying it disrupted coursework and examinations "at a critical time in the semester."

At Idaho State University, exams scheduled after noon Thursday were canceled entirely.

Pennsylvania State University told students that "no one has access" to Canvas and warned a "resolution" was unlikely within 24 hours. The university canceled multiple exams scheduled for Thursday and Friday.

In Canada, University of British Columbia informed students that Canvas was "unavailable due to a cyber breach of its parent company Instructure" and advised users to immediately log out.

University of Toronto also confirmed it had been impacted, stating that "multiple universities were affected."

Students at University of California Los Angeles struggled to submit assignments through Canvas, while University of Chicago temporarily shut down its Canvas page after reports it had been targeted.

The university newspaper, The Chicago Maroon, published a screenshot appearing to show a ransom demand from ShinyHunters.

The message urged the university to contact the hackers privately "to negotiate a settlement" and avoid "the release of their data."

That same threatening message appeared in an email received by Northwestern University master’s student Jacques Abou-Rizk.

"I didn't know what was happening," Abou-Rizk recalled. "It's a scary message to receive."

He said Northwestern University later sent a generic message stating it was "monitoring an issue."

According to the email seen by the BBC, the university said it had no estimated restoration time and that other IT systems had not been affected.

But by Friday, Abou-Rizk still could not access Canvas.

"There's definitely anxiety surrounding not only being able to complete my work and access the sites that I need access to on Canvas," he said. "But also just not knowing exactly what the threat is and how it might affect me."

"I don't know what data will be released, and that scares me."

The BBC said it contacted Northwestern University for comment.

ShinyHunters has previously been tied to several high-profile cyberattacks, including a damaging hack involving Jaguar Land Rover last year.

Luke Connolly, a threat analyst at cyber security firm Emsisoft, told the Associated Press that screenshots indicated the hackers began issuing threats on Sunday, with deadlines set for Thursday and May 12.

Connolly said negotiations involving possible extortion payments could still be happening behind the scenes.

The hacking group has not revealed what it intends to do with the data it claims to have stolen.

The cyber crisis erupted the same day that Chuck Schumer urged the Trump administration to strengthen America’s cyber defenses as AI-driven threats rapidly evolve.

In a letter, Schumer warned that the Department of Homeland Security must move quickly to help states and local governments defend against escalating cyber risks.

"Before Americans are hit with outages, disruptions, and attacks that could put lives and livelihoods at risk," he wrote.