San Antonio Schools Hit by Cyberattack on Canvas Learning Management System The Alamo Colleges District confirmed on Thursday that it is responding to a global cybersecurity incident targeting Canvas, a widely used learning management system (LMS). The attack has disrupted operations at multiple San Antonio-based institutions, including the University of Texas at San Antonio (UTSA), the University of the Incarnate Word (UIW), and the Alamo Colleges District itself. The incident, which appears to be part of a broader wave of cyber threats, has caused outages and service interruptions for students and faculty relying on Canvas for coursework, assignments, and communication. While details on the nature of the attack such as whether it involves ransomware, data breaches, or other malicious activity remain limited, the affected institutions are working to restore functionality and assess potential risks. The timing of the attack coincides with a critical period for academic institutions, as many prepare for midterm exams and ongoing coursework. The full extent of the impact on students, faculty, and administrative operations is still under evaluation. No specific threat actor or motive has been publicly identified at this time.

Interlock Ransomware Group Claims Attack on Community College of Beaver County In March 2026, the cybercriminal group Interlock took responsibility for a ransomware attack on Community College of Beaver County (CCBC), a public institution in Pennsylvania serving over 7,000 students. The attack, disclosed by CCBC on March 9, 2026, encrypted critical data and disrupted access to grades, transcripts, and financial records. The college temporarily closed its campus, with in-person classes resuming only on March 30. Interlock, which operates a data leak site, claimed to have stolen 780 GB of data, including personal records, financial documents, and contracts, which it threatened to release publicly. While the group has asserted responsibility, CCBC has not confirmed Interlock’s involvement, and key details such as the ransom demand, payment status, and breach method remain undisclosed. The college is conducting an investigation to determine the full scope of the incident. About Interlock First active in October 2024, Interlock is a ransomware operation that both encrypts systems and exfiltrates data, demanding payment for decryption and deletion of stolen files. Since its emergence, the group has claimed 98 attacks, with 47 confirmed by victims. Of those, 15 targeted educational institutions, highlighting a growing trend of ransomware threats against schools. Ransomware Surge in U.S. Education The CCBC attack is part of a broader wave of ransomware incidents affecting U.S. schools in 2026. Other recent victims include: - Denmark School District (WI) – January 2026 (Inc ransomware) - Alcorn School District (MS) – March 2026 (LockBit) - Lehigh Carbon Community College (PA) – March 2026 (Medusa) - Monmouth University (NJ) – March 2026 (PEAR) - Alamo Heights ISD (TX) – March 2026 Such attacks can cripple operations, leading to prolonged downtime, data loss, and heightened fraud risks for students and staff. Schools that refuse to pay may face extended disruptions, though compliance with ransom demands does not guarantee data recovery or attacker silence.