On May 7, 2026, the website Canvas was hacked. Canvas, a globally well-known platform that schools and universities use for students to manage their online classes and track grades. Following the breach of security, the hackers shared that they wanted a ransom of $275 million in return for not leaking schools’ personal details.
Canvas has more than 30 million users around the world, with many top-universities, including Harvard University and Princeton University, using Canvas to manage online courses. The website has personal details of students and teachers including addresses and social security numbers.
The hackers, known as ShinyHunters, breached Canvas’s security wall and sent emails to top-schools that were using the website. In the ransom note, the hackers demanded for the schools to pay the ransom or their information would be leaked. With finals week approaching for many schools, administrators were left with no other option but to go to the FBI.
“By receiving a message, that does not necessarily mean your personal information has been compromised,” an FBI agent said.
The ShinyHunters posted on the internet that they received access to thousands of messages between teachers, students and other staff members. With the threat of releasing the information, the FBI opened an investigation. The FBI also released that the ShinyHunters may not have as much information as they claim to have because Canvas recently reset their passwords so there is no serious threat to people’s security.
To ensure that no information would be leaked, the parent company of Canvas, Infrastructure, paid the ransom to ensure that the school’s data would not be leaked. Many schools were saved from their credentials and students’ grades from being leaked. Despite Canvas and Infrastructure taking back the website, they still warn users to not answer emails asking for personal information.
The FBI advises people to not address any sketchy emails and to not send personal details to anyone claiming to be in charge of the website. People are instructed to wait for updates on the news and to answer emails with suspicion. As of May 28, the creators of Canvas confirmed that they took back the website and that the ShinyHunters are no longer in control of students’ information.
