A major Canvas LMS outage caused by a cyberattack hit thousands of schools during finals week. Learn what happened and why secure AWS-hosted LMS platforms matter.
Canvas, one of the most widely used learning management systems in the U.S., was taken offline Thursday following a cyberattack on its parent company, Instructure. The platform was restored on Friday, May 8th, and is now fully available for most users.
According to CBS News, the hacking group ShinyHunters claimed responsibility for the breach, exploiting a vulnerability tied to Canvas's Free-For-Teacher accounts. Instructure responded by temporarily shutting down those accounts to contain the threat and restore the broader platform.
The timing could not have been worse — the outage hit at the height of finals season, leaving students unable to access course materials, grades, and assignments. Teachers scrambled to find workarounds, and several institutions, including the University of Texas at San Antonio and Penn State, postponed or canceled scheduled exams. Among the many affected schools were UCLA, Northwestern University, Columbia University, the University of Wisconsin-Madison, and the University of Illinois system.
ShinyHunters claimed that nearly 9,000 schools worldwide were impacted, with billions of private messages and records accessed. Cybersecurity analysts note that the attack bears similarities to a previous breach at PowerSchool, another widely used ed-tech platform, and that discussions around extortion payments may still be ongoing.
What This Means for EdTek Clients
