Cyberattack Disrupts Final Exams at Major U.S. Universities
A widespread cyberattack targeting Instructure, the company behind the cloud-based learning platform Canvas, disrupted final exams at thousands of universities across the U.S., including Rutgers, Princeton, and Ramapo in New Jersey. The attack, which began on May 7, forced institutions to cancel or postpone exams scheduled for May 8, leaving students without access to course materials and study resources.
The hacking group ShinyHunters claimed responsibility for the breach, which they described as a ransomware attack, and threatened to leak stolen personal data unless demands were met by May 12. Instructure confirmed the outage, stating that Canvas was placed in "maintenance mode" while investigating login issues, though the platform was later restored for most users by late May 7.
Universities scrambled to adapt, with administrators working overnight to distribute study materials via Google Drive and other alternatives. Rutgers-New Brunswick announced the postponement of Friday exams, while other affected institutions including Columbia, Harvard, the University of Michigan, and Penn State faced similar disruptions.
Canvas, used by over 8,000 institutions and 30 million active users worldwide, serves as a critical tool for course management. ShinyHunters, known for targeting major corporations, previously claimed to have stolen 80 million records from Rockstar Games in April. The incident highlights the growing vulnerability of educational platforms to cyber threats.
Instructure TPRM report: https://www.rankiteo.com/company/instructure-inc-
Princeton University TPRM report: https://www.rankiteo.com/company/princeton-university
Ramapo College TPRM report: https://www.rankiteo.com/company/ramapo-college-of-new-jersey
"id": "rampriins1778259449",
"linkid": "ramapo-college-of-new-jersey, princeton-university, instructure-inc-",
"type": "Ransomware",
"date": "5/2025",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'industry': 'Education',
'location': 'New Jersey, U.S.',
'name': 'Rutgers University',
'type': 'University'},
{'industry': 'Education',
'location': 'New Jersey, U.S.',
'name': 'Princeton University',
'type': 'University'},
{'industry': 'Education',
'location': 'New Jersey, U.S.',
'name': 'Ramapo College',
'type': 'College'},
{'industry': 'Education',
'location': 'New York, U.S.',
'name': 'Columbia University',
'type': 'University'},
{'industry': 'Education',
'location': 'Massachusetts, U.S.',
'name': 'Harvard University',
'type': 'University'},
{'industry': 'Education',
'location': 'Michigan, U.S.',
'name': 'University of Michigan',
'type': 'University'},
{'industry': 'Education',
'location': 'Pennsylvania, U.S.',
'name': 'Penn State University',
'type': 'University'},
{'customers_affected': '30 million active users',
'industry': 'Education Technology',
'location': 'U.S.',
'name': 'Instructure (Canvas)',
'type': 'EdTech Company'}],
'customer_advisories': 'Universities informed students about exam '
'postponements and alternative study materials',
'data_breach': {'data_exfiltration': 'Threatened to leak stolen data',
'personally_identifiable_information': 'Yes',
'sensitivity_of_data': 'High',
'type_of_data_compromised': 'Personal data'},
'date_detected': '2024-05-07',
'date_publicly_disclosed': '2024-05-07',
'date_resolved': '2024-05-07',
'description': 'A widespread cyberattack targeting Instructure, the company '
'behind the cloud-based learning platform Canvas, disrupted '
'final exams at thousands of universities across the U.S., '
'including Rutgers, Princeton, and Ramapo in New Jersey. The '
'attack forced institutions to cancel or postpone exams, '
'leaving students without access to course materials and study '
'resources.',
'impact': {'brand_reputation_impact': 'Yes',
'data_compromised': 'Personal data',
'downtime': 'Exams postponed/canceled on May 8',
'identity_theft_risk': 'Yes',
'operational_impact': 'Disruption of final exams and access to '
'course materials',
'systems_affected': 'Canvas learning platform'},
'investigation_status': 'Ongoing',
'motivation': 'Extortion',
'ransomware': {'data_exfiltration': 'Threatened',
'ransom_demanded': 'Yes (amount not specified)'},
'references': [{'source': 'Cyber Incident Description'}],
'response': {'containment_measures': 'Placed Canvas in maintenance mode',
'incident_response_plan_activated': 'Yes',
'recovery_measures': 'Distributed study materials via Google '
'Drive and other alternatives',
'remediation_measures': 'Restored platform for most users by '
'late May 7'},
'threat_actor': 'ShinyHunters',
'title': 'Cyberattack Disrupts Final Exams at Major U.S. Universities',
'type': 'Ransomware'}