A system that thousands of schools and universities use to support instruction was back online Friday after it went down during a cyberattack that created chaos as students tried to study for final exams.
The hacking group named ShinyHunters claimed responsibility for the breach at Canvas, said Luke Connolly, a threat analyst at the cybersecurity firm Emisoft. Instructure, the company behind Canvas, said in an update late Thursday that the system was available for most users.
Canvas is used to manage grades, course notes, assignments, lecture videos and more. The hacking group posted online that nearly 9,000 schools worldwide were affected, with billions of private messages and other records accessed, Connolly said.
Screen shots Connolly provided showed that the group began threatening Sunday to leak the trove of data. By Friday, Instructure and Canvas had been removed from a dedicated leak site created by the ransomware group on the dark web to publish stolen data.
The University of California system was also affected.
WebCampus access and Canvas services have been restored. Information provided directly by UNR states the University is aware that yesterday’s outage may have affected some final examinations, and faculty members are working directly with their students to identify appropriate alternative solutions where needed. At this time, the University’s final exam schedule remains unchanged. The University also expressed appreciation for the patience and flexibility shown by students and faculty as services were restored.
“According to a post published Friday on the University of Nevada, Reno’s official X account, the nationwide outage impacting Canvas was resolved by Instructure, the company that provides the learning platform. The university said WebCampus course materials, assignments, grading tools and communication features are once again accessible.
The university encouraged faculty to communicate clearly with students about how disruptions caused by the outage will be handled, noting the issue impacted students during a particularly stressful time in the semester. Students were advised to continue checking their Canvas inboxes for updates from instructors.
UNR also recommended that students and faculty download important course materials, content and class rosters from WebCampus as a precaution in case of any future service disruptions. The university said its Office of Information Technology will continue monitoring the situation.
In the post, the university thanked students and faculty for their patience and understanding during the outage and asked anyone still experiencing issues accessing WebCampus or Canvas to contact the Office of Digital Learning.”
Canvas went down Thursday at the worst possible time. Students quickly took to social media, with many panicking that they could no longer view course materials housed within the platform to study for their final exams.
Teachers said they were having to find workarounds to help students study for exams and submit final assignments. And some schools, such as the University of Texas at San Antonio, announced they were pushing back finals scheduled for Friday in response to the outage.
Schools like Princeton University turned to X late Thursday to announce “Canvas appears to be available again” and that information technology staff was monitoring the situation.
The University of California system created a webpage.
Rich in digitized data, the nation’s schools are prime targets for far-flung criminal hackers, who are assiduously locating and scooping up sensitive files that not long ago were committed to paper in locked cabinets. Past attacks have hit Minneapolis Public Schools and the Los Angeles Unified School District.
Instructure has not posted about the attack on its social media. The company didn’t immediately respond to emails from The Associated Press asking whether it paid a ransom and inquiring about what happened with the compromised data.
Connolly said the Canvas attack is strikingly similar to a breach at PowerSchool, which also offers learning management tools. In that case a Massachusetts college student was charged.
Connolly described ShinyHunters as a loose affiliation of teenagers and young adults based in the U.S. and the United Kingdom. The group also has been tied to other attacks, including one aimed at Live Nation’s Ticketmaster subsidiary.
(Copyright 2026 The Associated Press. All rights reserved. This material may not be published, broadcast, rewritten or redistributed without permission.)
