Millions of college and K-12 students in North America accessed the site to undertake their final tests and assignments yesterday, but what met them was a blank screen and a threatening message from the hackers – Canvas has been hacked.

This popular educational technology software that is used by over 30 million people across thousands of institutions has now been shut down following a serious cybersecurity breach involving the notorious group known as ShinyHunters.

The hackers claimed they had accessed private messages and data from 275 million students, teachers, and staff across nearly 9,000 schools worldwide. In a bold warning, they gave affected institutions until May 12, 2026, to negotiate or face a full data leak.

Instructure, the company behind Canvas, confirmed the breach involved names, email addresses, student IDs, and user messages. No passwords, financial data, or government identifiers were reportedly stolen. The company temporarily shut down Free-for-Teacher accounts after discovering the attackers had exploited them and even made visible changes while users were logged in.

Canvas has since been restored for most users, but several major universities — including Penn State, the University of Illinois, and Baylor — were forced to postpone or cancel final exams due to the outage.

This breach is more than just a technical glitch during one of the most stressful times in the academic year. It exposes the extreme vulnerability of the digital infrastructure that modern education now depends on. With finals week in full swing, thousands of students suddenly lost access to course materials, grades, and submission portals at the worst possible moment.

ShinyHunters’ track record suggests they are not bluffing. Their threat to dump massive amounts of sensitive student data — including private messages — creates a nightmare scenario for schools and families. Even if the immediate outage has been resolved, the long-term risk of leaked personal information and potential phishing attacks remains high.

Security experts are urging students and faculty to treat this as a wake-up call: use strong, unique passwords, enable multi-factor authentication everywhere, and remain highly suspicious of any unsolicited messages claiming to be from Canvas or professors.

This incident raises serious questions about how secure our education systems really are in the digital age. As schools become ever more dependent on third-party platforms, one successful breach can disrupt the lives of millions in an instant.

The coming days will reveal whether the hackers follow through on their May 12 deadline — and just how much private academic data ends up exposed.