Hackers Just Exposed 275 Million Students — And Timed It Perfectly for Finals Week

The ShinyHunters ransomware group has breached Canvas, the platform used by Harvard, Princeton, and 9,000 schools worldwide. Here’s what happened, what’s at risk, and what every student should do right now.

Imagine sitting down to study for your final exam — the one that determines whether you pass the semester — and the platform where every lecture, reading, and past exam lives suddenly goes dark.

That’s not a hypothetical. That’s what happened to millions of students across the world this week.

Canvas, the digital classroom platform used by over 30 million people at more than 8,000 institutions globally, was hit by one of the most destructive ransomware attacks in the history of education.

Who Did This — and What They Took

The group behind the attack is called ShinyHunters — a notorious cybercriminal collective you may remember from the massive Ticketmaster breach in 2024. They’re not amateurs. They’re described by cybersecurity experts as a cluster of skilled operatives working remotely together, structured like a professional ransomware gang.

Their ransom note appeared directly on Canvas login pages at schools including Harvard, Princeton, Columbia, Georgetown, Rutgers, Penn State, and thousands of K-12 districts across the United States — as well as institutions in the Netherlands, New Zealand, Australia, Sweden, and beyond.

The message was chilling and direct: they claimed to have breached Instructure, Canvas’s parent company, and accessed data belonging to 275 million individuals — including billions of private messages between students and teachers. The deadline for schools to negotiate a settlement or face full data exposure? May 12, 2026.

The Timing Was Brutal

Cybersecurity experts will tell you that attackers choose their moments deliberately. And this moment — finals season, when students and professors are most dependent on the platform and most panicked at its loss — was chosen with precision.

The University of Illinois postponed all final exams and assignments scheduled through Sunday. Penn State canceled exams. Baylor University delayed finals entirely and urgently asked professors to email study materials directly to students from their own computers. Across the country, professors scrambled while students panicked.

“I’m sure somewhere in the country when the outage happened, there probably were people actually taking final exams on the platform when it crashed,” said one University of Pennsylvania lecturer.

A sixth-grade student in Wake County, North Carolina summed it up simply: “I went onto the app. I couldn’t find it. I texted my friends: ‘Where is it?’”

What Instructure Says — and What You Should Do

Instructure claims the breach was first detected on April 29 and says it found no evidence that passwords, dates of birth, government IDs, or financial information were compromised. The company has since restored access for most users and shut down its Free-For-Teacher accounts while investigating.

But cybersecurity experts aren’t entirely reassured.

“Even if there was no breach yesterday, I would say these are the things I recommend you do,” said Rachel Tobac, CEO of SocialProof Security: Use a password manager. Turn on multi-factor authentication everywhere. And be politely paranoid about unexpected emails, texts, and calls.

The deeper lesson this breach is forcing us to confront is one the education sector has been avoiding for years: the entire architecture of modern learning runs through a single, centralized platform. When that platform goes dark, education itself grinds to a halt. That is a vulnerability no patch can fully fix.

The May 12 deadline has not passed. This story is not over.

If you’re a student, parent, or educator affected by this breach — or if this story alarmed you — share it with someone who needs to read it. And if you found it valuable, a like or tip means the world.