The afternoon of May 7, students across the country opened their Canvas accounts expecting to access their usual homework assignments and class syllabi. Instead, many were met with a black screen displaying an ominous message: “ShinyHunters has breached Instructure (again)… You have till the end of the day by 12 May 2026 before everything is leaked.”
Canvas was temporarily shut down nationwide that afternoon by Instructure—the parent company of the website—following a cybersecurity incident by a group of hackers calling themselves ShinyHunters.
“If any of the schools in the affected list are interested in preventing the release of their data, please consult with a cyber advisory firm and contact us privately at TOX to negotiate a settlement,” ShinyHunters’ message wrote.
The deadline to contact ShinyHunters was the same for Instructure: end of day May 12, 2026.
The day before the deadline, a statement posted by Instructure announced that the company had reached an agreement with ShinyHunters, referred to as an “unauthorized actor” by Instructure. Part of the agreement included a return of all data to Instructure. The agreement included digital confirmation of data destruction, meant to ensure that no extortion will occur to any Instructure customers due to the incident.
Seattle University Information Security Officer Jerry Vergeront has been part of the team in contact with Instructure about the incident.
“We were contacted on the fifth, last Tuesday, of a possible security event, but were given no confirmation of what data was accessed,” Vergeront said.
With this information on hand, Vergeront and his team were on high alert, monitoring Canvas, and noticed the hack within minutes. They sent out information to students and faculty via Redhawks Hub starting at 2:17 p.m. May 7, advising users not to attempt to access Canvas until further notice.
Students were immediately concerned about the status of their data, as well as whether classes, midterms or homework assignments would be postponed. President of Student Government of Seattle U Diego Gonzalez had both students and professors bringing these concerns to him.
“[Professors] were also freaking out because they didn’t know what to do. They didn’t know how to support students. They didn’t know when Canvas was going to come online. All that unknown caused a lot of uncertainty, which resulted in stress from everybody at the university,” Gonzalez said.
ShinyHunter’s decision to compromise a major learning platform affected thousands of students and faculty near the end of their semesters or quarters. The scale of impact showed why targeting third-party vendors is attractive to extortion groups.
For Seattle U, Canvas was accessible by 10 p.m. March 7, a fairly quick turnaround compared to other affected universities, with UW gaining access later that weekend. Seattle U IT Services has not released their role or process in regaining access to Canvas. Despite the quick turnaround, the effects of even a brief outage show just how reliant school systems have become on e-learning platforms such as Canvas.
Professor Erik Moore, the program director for Seattle U’s online MS in cybersecurity leadership, viewed this cybersecurity incident as an evolution of cyber attacks. By targeting Instructure, Canvas’s parent company, Shinyhunters were able to impact thousands of schools at once.
Moore believes that the data exfiltrated by ShinyHunters during their attack was from Instructure, not any direct Seattle U systems, so their reach should be limited to student and faculty interactions. According to Instructure, usernames, emails, course names, enrollment information and messages were accessed by the hackers, but course content, submissions and credentials were not compromised
Going forward, Moore advises that people approach online spaces, such as Canvas, as being out in public with the assumption that any of those interactions or information can be exfiltrated at any moment. He also encouraged diligence about password reuse, continued use of two-factor authentication and consistently updating your software.
The latest update from Seattle U IT Services on May 11 stated that Canvas continues to be available and that they do not expect any further disturbances.
