ShinyHunters hijack Penn Canvas, threaten data dump over ransom
TL;DR
ShinyHunters took Penn’s Canvas offline, claiming a vulnerability in Instructure and demanding a settlement to prevent a data leak, with a May 12, 2026 deadline; the group says it has access to hundreds of millions of user records, including Penn emails, names, Penn IDs, and course enrollments, and Penn is investigating with Instructure and law enforcement while other institutions are affected.
- Cybercrime group crashes Penn’s Canvas system, demands ransom to prevent data release The Daily Pennsylvanian
- “PAY OR LEAK”: Hackers Target Big Higher Ed Vendor Inside Higher Ed
- Universities of Wisconsin affected by nationwide Canvas outage Channel 3000
- Millions of students’ personal data stolen in major education breach Malwarebytes
- Duke among 9,000 schools affected by Canvas cyberattack The Duke Chronicle
Want the full story? Read the original reporting
Read on The Daily Pennsylvanian