It started with students logging into Canvas and seeing a ransom note from a hacking group calling itself Shinyhunters.