UC Davis Canvas down after hackers breach learning management platform

Student and staff records are at risk as cybercrime group Shiny Hunters seeks to extort parent company Instructure

Canvas, UC Davis’ main learning management platform, has crashed after the company behind it was hacked by cybercrime and extortion group Shiny Hunters.

In a red warning message displayed to some users attempting to access Canvas, the group threatens the release of obtained data if Instructure, an educational technology company that owns Canvas, does not pay a ransom by May 12. It is unclear how much they have asked from the company.

The group also encouraged individual universities and institutions to reach out to them privately if they wish to prevent their data from being leaked.

Canvas users and customers nationwide have been affected, with both the Canvas website and the mobile app down for hundreds of thousands of university and K-12 students. Shiny Hat said they have records from some 8,000 school districts, individual schools and universities, as well as data from 240,000 users.

UC Davis spokesperson James Nash said the issue is being handled at the University of California (UC)-level, as the vendor contract is managed by the system at large. As of 3 p.m. on May 7, UC Davis Canvas displays a scheduled maintenance page to users when attempting to access it.

Instructure first reported a cybersecurity incident on Friday, May 1. Shiny Hunters said they set an initial May 6 deadline, which Instructure did not comply with.

A list of affected universities published by the hacker group indicates that several other UC campuses have been targeted, including UC Berkeley, UC Los Angeles, UC Riverside, UC San Diego and UC Irvine. Notably, UC Santa Cruz, UC Santa Barbara and UC Merced — which also use Canvas — are not listed as being affected.

Around 41% of higher education institutions in the country use Canvas, more than double those using the next most popular platform, Blackboard, according to 2024 data.

This is a developing story.

Written by: Vince Basada — campus@theaggie.org