Instructure and Parchment: University of Minnesota hack: Cyberattack hits thousands of schools nationwide during final exams

Cyberattack on Canvas Platform Threatens Data of Millions of Students Nationwide

The University of Minnesota (U of M) and nearly 8,000 other schools across the U.S. have been impacted by a cyberattack targeting Canvas, an educational software platform used for assignments, exams, grades, and lecture materials. The breach, claimed by the hacking group ShinyHunters, threatens to release the personal data of up to 270 million users unless a ransom is paid by May 12.

The attack disrupted access to Canvas on Thursday afternoon, prompting Instructure the parent company to temporarily shut down the platform. While officials state there is no evidence that passwords, Social Security numbers, or financial data were compromised, the hackers allege they breached the system a second time after Instructure applied security patches instead of engaging with their demands.

Local school districts and universities, including U of M, have issued alerts to students and parents. U of M’s website confirmed the outage and noted that transcript ordering via Parchment another Instructure-owned service has been suspended as a precaution.

The incident coincides with the end of the academic year, with final exams underway and graduations at U of M scheduled for next week. The full scope of the hackers’ demands remains undisclosed.

Source: https://www.fox9.com/news/university-minnesota-hack-cyberattack-schools-may-8

Instructure cybersecurity rating report: https://www.rankiteo.com/company/instructure-inc-

Parchment by Instructure cybersecurity rating report: https://www.rankiteo.com/company/parchment

"id": "INSPAR1778272297",
"linkid": "instructure-inc-, parchment",
"type": "Ransomware",
"date": "5/2025",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"

{'affected_entities': [{'industry': 'Education',
                        'location': 'Minnesota, USA',
                        'name': 'University of Minnesota',
                        'type': 'University'},
                       {'customers_affected': 'Nearly 8,000 schools',
                        'industry': 'EdTech',
                        'name': 'Instructure (Canvas parent company)',
                        'type': 'Company'}],
 'customer_advisories': 'Alerts issued to students and parents',
 'data_breach': {'data_exfiltration': 'Threatened by hackers',
                 'number_of_records_exposed': 'Up to 270 million users',
                 'personally_identifiable_information': 'Yes',
                 'sensitivity_of_data': 'High (personal data, though no '
                                        'evidence of passwords, SSNs, or '
                                        'financial data)',
                 'type_of_data_compromised': 'Personal data'},
 'date_detected': '2024-05-09T00:00:00Z',
 'description': 'The University of Minnesota (U of M) and nearly 8,000 other '
                'schools across the U.S. have been impacted by a cyberattack '
                'targeting Canvas, an educational software platform used for '
                'assignments, exams, grades, and lecture materials. The '
                'breach, claimed by the hacking group ShinyHunters, threatens '
                'to release the personal data of up to 270 million users '
                'unless a ransom is paid by May 12.',
 'impact': {'brand_reputation_impact': 'Yes',
            'data_compromised': 'Personal data of up to 270 million users',
            'downtime': 'Temporary shutdown of Canvas platform',
            'identity_theft_risk': 'Potential',
            'operational_impact': 'Disrupted access to assignments, exams, '
                                  'grades, and lecture materials; suspended '
                                  'transcript ordering',
            'payment_information_risk': 'No evidence of compromise',
            'systems_affected': 'Canvas platform, Parchment transcript '
                                'ordering service'},
 'investigation_status': 'Ongoing',
 'motivation': 'Extortion',
 'ransomware': {'data_exfiltration': 'Threatened',
                'ransom_demanded': 'Undisclosed',
                'ransom_paid': 'No'},
 'references': [{'source': 'University of Minnesota website'}],
 'response': {'communication_strategy': 'Issued alerts to students and '
                                        'parents, confirmed outage on website',
              'containment_measures': 'Temporarily shut down the Canvas '
                                      'platform, applied security patches',
              'incident_response_plan_activated': 'Yes',
              'remediation_measures': 'Applied security patches'},
 'stakeholder_advisories': 'Alerts issued to students and parents',
 'threat_actor': 'ShinyHunters',
 'title': 'Cyberattack on Canvas Platform Threatens Data of Millions of '
          'Students Nationwide',
 'type': 'Ransomware'}