A widespread cyberattack hit the online learning platform Canvas on Thursday, throwing final exams into chaos at schools and colleges nationwide.
Parent company Instructure said the platform was restored by Friday morning after it was taken offline due to unauthorized network activity.
The threat actor, identified as the ransomware group ShinyHunters, claimed responsibility. They asserted they accessed data from 275 million users across 8,800 schools. Instructure stated accessed data included names, email addresses, student IDs, and in-platform messages, but not passwords, dates of birth, or financial information.
During the outage, Canvas login pages displayed a ransom demand, alleging Instructure had refused earlier demands and urging individual schools to negotiate.
The University of Illinois postponed all finals through the weekend. The University of Massachusetts Dartmouth rescheduled exams, and University of California campuses were directed to stand by.
ShinyHunters is the same group behind the 2024 data breach of cloud provider Snowflake, which led to further compromises of customers like TicketMaster.