Ransomware Attack Disrupts Learning Systems at University of Iowa, Iowa State, and Global Institutions
A ransomware group has claimed responsibility for breaching Canvas, a widely used learning management system, disrupting access for students and faculty at the University of Iowa, Iowa State University, and schools worldwide. The attack, announced on May 9, coincided with final exams and assignment deadlines, affecting an estimated 30 million users globally.
Both universities issued alerts on Thursday afternoon, urging instructors to adjust deadlines and offer alternative submission methods. The University of Iowa’s IT team confirmed ongoing communication with the vendor to restore service, acknowledging the disruption during a critical academic period.
The ransomware group issued a demand, threatening to leak stolen data unless negotiations are completed by May 12. The breach may have exposed personal information of students, teachers, and staff. As of now, the Canvas app displays an error message, leaving users unable to access course materials.
The incident highlights the vulnerability of educational platforms during high-stakes periods, with universities working to mitigate the impact on academic continuity.
Canvas TPRM report: https://www.rankiteo.com/company/scannedwithcanvas
Iowa State University TPRM report: https://www.rankiteo.com/company/iowastateu
"id": "iowsca1778207736",
"linkid": "iowastateu, scannedwithcanvas",
"type": "Ransomware",
"date": "5/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'industry': 'Education',
'location': 'Iowa, USA',
'name': 'University of Iowa',
'type': 'University'},
{'industry': 'Education',
'location': 'Iowa, USA',
'name': 'Iowa State University',
'type': 'University'},
{'customers_affected': '30 million users',
'industry': 'Education',
'location': 'Global',
'name': 'Global educational institutions using Canvas',
'type': 'Educational institutions'}],
'customer_advisories': 'Urged instructors to adjust deadlines and offer '
'alternative submission methods',
'data_breach': {'data_exfiltration': 'Threatened to leak stolen data',
'personally_identifiable_information': 'Yes',
'sensitivity_of_data': 'High',
'type_of_data_compromised': 'Personal information'},
'date_detected': '2024-05-09',
'date_publicly_disclosed': '2024-05-09',
'description': 'A ransomware group has claimed responsibility for breaching '
'Canvas, a widely used learning management system, disrupting '
'access for students and faculty at the University of Iowa, '
'Iowa State University, and schools worldwide. The attack '
'coincided with final exams and assignment deadlines, '
'affecting an estimated 30 million users globally. The '
'ransomware group issued a demand, threatening to leak stolen '
'data unless negotiations are completed by May 12. The breach '
'may have exposed personal information of students, teachers, '
'and staff.',
'impact': {'data_compromised': 'Personal information of students, teachers, '
'and staff',
'downtime': 'Ongoing as of May 9',
'identity_theft_risk': 'High',
'operational_impact': 'Disrupted access to course materials during '
'final exams and assignment deadlines',
'systems_affected': 'Canvas learning management system'},
'investigation_status': 'Ongoing',
'lessons_learned': 'Highlights the vulnerability of educational platforms '
'during high-stakes periods',
'motivation': 'Financial gain',
'ransomware': {'data_exfiltration': 'Threatened', 'ransom_demanded': 'Yes'},
'references': [{'date_accessed': '2024-05-09',
'source': 'Incident description'}],
'response': {'communication_strategy': 'Issued alerts to instructors and '
'students, urged deadline adjustments '
'and alternative submission methods',
'incident_response_plan_activated': 'Yes',
'remediation_measures': 'Ongoing communication with vendor to '
'restore service'},
'stakeholder_advisories': 'Universities issued alerts to instructors and '
'students',
'threat_actor': 'Ransomware group',
'title': 'Ransomware Attack Disrupts Learning Systems at University of Iowa, '
'Iowa State, and Global Institutions',
'type': 'Ransomware'}