Canvas, a learning management platform used worldwide by approximately 9000 institutions of higher learning, shut down worldwide after a massive data breach. This data breach impacted student names, ID numbers, messages, and has made the platform unavailable to access for students and faculty.
As of early Thursday, a message from the hacking group ShinyHunters, claimed responsibility for the attack. The group said they would release the data unless they were paid a ransom. The platform shut down around 1 p.m. today, and hasn’t been accessible since.
(Provided by Katherine Zagone)
The message from ShinyHunters included a link to a list they claim to have breached through Canvas. They said that Canvas did not contact or resolve with them. The message then said that if any schools want to prevent their data being released they are to contact them privately at “TOX” by May 12 2026 to negotiate something before they leak the information they’ve gained.
The platform’s status page says Canvas, Canvas Beta, and Canvas Test are currently unavailable and that it is investigating the outage. The Canvas outage is being reported world wide and by several prestigious universities and affects 275 million students and faculty.
Signal reached out to the OIT Office of Information Technology and spoke with Pablo Gonzalez (Senior, Business Administration).
“We are not too worried about it. Canvas outages don’t last long,” Gonzalez said.
OIT Communications sent out an email to students and faculty at 4:27 p.m. informing them about the cyber security hack.
-
Email sent out by OIT at 4:27 pm on Thursday May 7 2026.
-
Email sent out by OIT explaining the unavailability of Canvas at 3:06 pm on Thursday May 7 2026.
| “We have been informed that the threat actor accessed data from many educational institutions worldwide stored at Instructure’s site that likely included information from the CSU,” OIT communications said. “Instructure is still confirming what data may have been exposed, but based on their preliminary assessment, it may include personal information such as names, email addresses, student ID numbers and user messages.”
The email said that they cannot confirm if any data from Stan States has been included at the time. They continued to state that canvas does not store any personal information. “Canvas does not store passwords, Social Security numbers, financial information or dates of birth,” OIT Communications said. OIT Communications said they will continue to work with Instructure and will provide updates. Signal has reached out to the president’s office as well as Rosalee Rush, Vice President of Strategic Communications and Marketing, we are awaiting comment. |
On Thursday May 7, around 10:25 p.m., Stan State’s Office of Information Technology (OIT), sent out an email that California State University campuses had temporarily blocked Canvas access which would not be restored until they were confident the system was secure.
-
Email sent from the Office of Information Technology on Thursday May 7, 2026, at 10:57 p.m. sharing how the CSU would not be restoring access till the system was secure.
-
Second portion of the email sent from the Office of Information Technology on Thursday May 7, 2026, at 10:57 p.m.
On Friday May 8, around 12:20 p.m., OIT sent out an update that the Canvas platform was back online but the CSU had not fully reintegrated all campus data connections with Canvas.
“CSU has been actively working closely with state partners and security teams to ensure all recommended security protocols and validations are fully completed before restoring access to Canvas, which we anticipate will be no later than early this afternoon,” said the Office of Information Technology.
-
Email sent from the Office of Information Technology sharing how the Canvas was back online but the CSU had not fully reintegrated their data connections with Canvas on May 8, 2026, at 12:20 p.m.
-
Email sent from the Office of Information Technology sharing how Canvas was fully restored on May 8, 2026, at 2:30 p.m.
Later in the day, OIT sent out a final email around 2:30 p.m. that Canvas was fully restored on campus.
“Following careful validation in coordination with CSU systemwide teams and security partners, the University has confirmed that it is safe to resume normal use of Canvas for teaching, learning and coursework,” said the Office of Information Technology.
The Office of Information Technology continued to share that anyone continuing to experience issues accessing Canvas or course materials should contact the Technology Support Desk.
This story has been updated to include more information on the Canvas outage and its restoration.
