A hacking attack on a learning management platform led to panic among college students nationwide as they attempted to access their grades and other class materials on May 7.
Canvas announced May 7 that its parent company, Instructure, experienced a security incident and outage, forcing the platform to shut down during what, for many students, is spring finals week. Instructure said Canvas has more than 30 million active users worldwide and serves over 8,000 institutions.
Several universities in Tennessee use the software program to run their class modules, and due to the severity of the outage, some have had to adjust finals week.
Here's what to know about the outage.
Canvas hacked during finals week for most schools
Canvas, a cloud-based learning management platform used by thousands of schools and universities, was hacked and disabled for hours on May 7, multiple news organizations and college student newspapers reported.
By late May 7, Instructure announced on its status page that Canvas was "now available for most users." Earlier, the company had placed Canvas and other related sites "in maintenance mode" while investigating an issue that caused some users to have difficulty logging into Student ePortfolios.
Who hacked Canvas?
The hacking group ShinyHunters has taken credit for the data breach involving Instructure, the company behind the Canvas learning management system, as reported by The New York Times and CNN.
In a ransom letter shared on May 3 by Ransomware.live, a platform that tracks and monitors ransomware groups, ShinyHunters said it had accessed data from over 275 million people — including students, teachers, and other staff — across nearly 9,000 schools worldwide.
ShinyHunters has a history of compromising global corporations, according to Reuters. In April, the hacking group claimed it had stolen nearly 80 million business records from Rockstar Games, the developer of Grand Theft Auto.
What data was taken in the Canvas security attack?
The investigation into the April 29 incident has revealed that personal information from users at affected organizations was compromised, including names, email addresses, student ID numbers, and Canvas messages.
Instructure found no evidence that passwords, dates of birth, government IDs, or financial information were involved. There is also no evidence of data being taken during the May 7 activity. The investigation is ongoing.
Tennessee universities experience Canvas hacking during finals week
On May 7, the University of Tennessee, Knoxville, reported in an email to the school that the parent company of Canvas had shut down due to a cybersecurity incident.
"We want to make you aware of a recent cybersecurity incident involving the vendor who manages the Canvas platform," the university wrote to families and staff members. "Users may have seen an unauthorized message upon logging in. Our Technology Department is actively working with Instructure, the Canvas platform vendor, and has already removed the message."
In response to the outage-induced panic, the university announced on May 8 that despite the program operating again, it would move the May 8 exams to May 9. The school will make accommodations for students who will be negatively affected by the schedule change.
At the University of Memphis, a similar situation occurred. In the middle of finals week for the Tigers, the Canvas outage interrupted exams and submissions for students across the network.
Reportedly, there was an indication prior to the May 7 attack that the program would have issues.
"In a university press release on Wednesday, officials said Instructure disclosed on May 1 that a recent security incident resulted in a data breach and later confirmed the University of Memphis was among the affected institutions," The Daily Helmsman, the school's newspaper, wrote on May 7.
There have been no announcements from the university about changing the exam schedule or altering professors' deadlines.
MTSU Sidelines, the student newspaper for Middle Tennessee State University, reported that the school was affected by the Canvas outage on May 7.
The university is currently transitioning from D2L, another similar learning management system, to Canvas. MTSU is still transitioning between the two programs but aims to be fully operating on Canvas by Fall 2026.
The school's exam period ended on May 6, but projects and grades submitted through the Canvas system are still being worked on.
https://www.commercialappeal.com/story/news/education/2026/05/08/canvas-hacked-what-happened-tennessee-data-breach/89991586007/