Cyberattack Disrupts Canvas Learning Portal at Major Universities Worldwide Hackers breached Instructure Inc.’s Canvas platform this month, forcing the company to temporarily suspend services for thousands of colleges and universities globally. The attack, detected on May 1, exploited a vulnerability in a teacher-specific account, granting unauthorized access to some of the company’s websites. While much of the service was restored by May 2, affected teacher accounts remain suspended. Canvas, a widely used learning management system, supports critical academic functions, including exams, assignments, and grade tracking. The outage impacted institutions such as Harvard, Princeton, Stanford, Yale, Columbia, the University of Oslo, and Australia’s Adelaide University, disrupting operations for students and faculty. The extent of data exposure remains unclear, though some universities reported potential breaches of user information. Yale warned that names, email addresses, and internal messages may have been accessed, while Stanford flagged possible exposure of student IDs and communications. Rutgers and Baylor noted uncertainty around compromised data, with Baylor cautioning about subsequent phishing attempts targeting students. The cybercrime group ShinyHunters claimed responsibility in a dark web post, though Instructure has not confirmed their involvement. Known for data theft and extortion, the group has previously targeted educational institutions, including a 2023 wave of attacks on Ivy League schools that exposed alumni and student records. Instructure, acquired by private equity firm KKR in a $4.8 billion deal earlier this year, was previously majority-owned by Thoma Bravo. The Salt Lake City-based company, founded in 2008, has not disclosed whether sensitive data was exfiltrated during the incident.

ShinyHunters Claims Major Data Breach of Udemy, Threatens to Leak 1.4M Records On April 24, 2026, the cybercriminal group ShinyHunters announced a data breach targeting Udemy, one of the world’s largest online learning platforms, alleging the theft of over 1.4 million records containing personally identifiable information (PII) and internal corporate data. The group issued a "Pay or Leak" ultimatum, demanding a response from Udemy by April 27, 2026, or risk public exposure of the stolen data. ShinyHunters, a financially motivated extortion group active since 2019, has built a reputation for high-profile breaches, including the 2020 theft of 200 million records from 13 companies. In 2026 alone, the group has intensified attacks on SaaS platforms and the education sector, with recent victims including Vercel, McGraw-Hill, and Harvard University (where 115,000 alumni records were exposed). Google Threat Intelligence tracks the group under the designation UNC6240, noting its shift from traditional network exploitation to social engineering, MFA bypass, and credential harvesting. ShinyHunters often exploits third-party integrations and compromised vendor credentials, as seen in the Vercel breach, where a third-party vendor (Context.ai) served as the entry point. The education sector remains a prime target, with ShinyHunters previously breaching India’s Unacademy, stealing over 10 million user accounts. As of publication, Udemy has not confirmed or denied the breach, and researchers continue monitoring the group’s leak site for potential data release following the deadline. The incident underscores the group’s evolving tactics and persistent focus on high-value targets.

Higher Education Under Siege: A Wave of Cyberattacks Exposes Systemic Vulnerabilities In the first half of 2025, a surge of cyberattacks has targeted major U.S. universities, exposing critical weaknesses in higher education’s cybersecurity defenses. The University of Pennsylvania, Harvard University, and Princeton University all reported breaches within the past two months, following earlier incidents at Columbia University, Dartmouth College, and New York University. Each institution confirmed the attacks stemmed from social engineering, with Harvard and Princeton specifically citing phone-based phishing as the entry point. Officials at the affected schools stated they acted swiftly to contain the breaches and are reinforcing security measures. However, experts warn that universities face an uphill battle. Mike Corn, a former chief information security officer in higher education and current consultant at Vantage Technology, noted that colleges operate like "small cities," with decentralized networks, personal devices, and diverse user behaviors creating countless vulnerabilities. Even robust investments in cybersecurity, he argued, cannot guarantee immunity from attacks—especially as AI-driven threats grow more sophisticated. The challenges extend beyond technology. Brian Nichols, CIO at the University of Kentucky, highlighted that while phishing simulations and training have improved awareness, they are not foolproof. Anita Nikolich, director of research and technology innovation at the University of Illinois at Urbana-Champaign, warned that punitive security measures can backfire, alienating faculty who may resist protocols perceived as restrictive. A core tension lies in academic freedom versus centralized IT control: many universities allow individual departments—such as medical or business schools—to maintain separate IT teams, increasing risk. Nikolich, who previously led IT infrastructure at the University of Chicago, described this fragmentation as a "huge risk factor," as decentralized systems complicate consistent security enforcement. Faculty resistance further complicates the issue. Janice Lanham, a nursing lecturer at Clemson University, nearly fell victim to a phishing scam but caught the deception in time. Yet, as Brian Voss, Clemson’s CIO, observed, some professors view security protocols as obstacles to research and teaching. Voss described a "culture of subservience" in higher-ed IT, where departments prioritize faculty demands over security, often retaining excessive data—including sensitive information like Social Security numbers—despite the risks. His efforts to reduce data storage have met resistance, with one university even retaining personal data for voter registration purposes, creating what he called "piles of gold for bad guys." The conflict between research needs and security is particularly acute. Nikolich, who also conducts quantum computing research, faced initial pushback when requesting network data for her work. After demonstrating the data’s non-sensitive nature and potential security benefits, she gained access—but noted that other universities default to blanket denials. When researchers are blocked, she warned, they often bypass official channels, increasing exposure. The solution, Nikolich suggested, lies in collaboration: IT, security teams, and faculty must treat cybersecurity as a shared priority, balancing innovation with protection. Until then, universities remain prime targets—caught between the demands of open academic environments and the escalating sophistication of cyber threats.

A Princeton University graduate has filed a federal class-action lawsuit accusing the Ivy League institution of negligence and breach of contract after a phone-based phishing attack exposed personal data belonging to students, parents, alumni, donors, and staff members. The suit, filed Nov. 24 in U.S. District Court in New Jersey, alleges the university failed to secure and encrypt sensitive information stored in its University Advancement database — including birth dates, home addresses, family details, employment histories, giving records, and wealth indicators — allegedly leaving tens of thousands of people vulnerable to identity theft and long-term financial and privacy risks. “We believe this claim is without merit, and we plan to contest it vigorously,” a spokesman for Princeton University said on Wednesday. The plaintiff in the lawsuit, Gary Penna, a Massachusetts resident and Princeton alum and past donor, seeks to represent a nationwide class of individuals whose data “may have been compromised” when cybercriminals infiltrated the system Nov. 10. Princeton officials have said the breach stemmed from a targeted phone phishing attack on an employee with access to the database, and that it is working with law enforcement and outside cybersecurity experts. Be more informed and empowered with the facts. Never miss a story. Sign up for our free newsletter. → Allegations of negligence and a failure to meet basic standards The 63-page complaint alleges that the univers

Clop Ransomware Gang Steals Data of 3.5 Million from University of Phoenix The Clop ransomware gang has stolen the personal and financial data of nearly 3.5 million individuals—including current and former students, staff, and suppliers—after breaching the University of Phoenix (UoPX) network in August 2025. The attack was part of a broader extortion campaign exploiting a zero-day vulnerability (CVE-2025-61882) in Oracle E-Business Suite (EBS), a financial application used by the university. UoPX, a private for-profit institution based in Phoenix, Arizona, detected the breach on November 21 after Clop listed the university on its data leak site. The stolen data includes names, contact details, dates of birth, Social Security numbers, and bank account information. In early December, the university publicly disclosed the incident and filed an 8-K report with the U.S. Securities and Exchange Commission (SEC). On Monday, UoPX confirmed in notification letters filed with Maine’s Attorney General that 3,489,274 individuals were affected. The university is offering free identity protection services, including credit monitoring, dark web surveillance, and a $1 million fraud reimbursement policy. While UoPX has not officially attributed the attack, the tactics align with Clop’s recent campaign targeting Oracle EBS vulnerabilities. Other U.S. universities, including Harvard and the University of Pennsylvania, have also reported similar breaches linked to the same exploit. Clop has a history of high-profile data theft operations, previously targeting GoAnywhere MFT, Accellion FTA, MOVEit Transfer, Cleo, and Gladinet CentreStack. The U.S. Department of State has offered a $10 million reward for information connecting the gang’s activities to a foreign government. In a separate wave of attacks since late October, multiple universities—including Harvard, Princeton, and the University of Pennsylvania—have also fallen victim to voice phishing (vishing) attacks, compromising systems tied to development and alumni activities.

Cyberattack Disrupts Final Exams at Major U.S. Universities A widespread cyberattack targeting Instructure, the company behind the cloud-based learning platform Canvas, disrupted final exams at thousands of universities across the U.S., including Rutgers, Princeton, and Ramapo in New Jersey. The attack, which began on May 7, forced institutions to cancel or postpone exams scheduled for May 8, leaving students without access to course materials and study resources. The hacking group ShinyHunters claimed responsibility for the breach, which they described as a ransomware attack, and threatened to leak stolen personal data unless demands were met by May 12. Instructure confirmed the outage, stating that Canvas was placed in "maintenance mode" while investigating login issues, though the platform was later restored for most users by late May 7. Universities scrambled to adapt, with administrators working overnight to distribute study materials via Google Drive and other alternatives. Rutgers-New Brunswick announced the postponement of Friday exams, while other affected institutions including Columbia, Harvard, the University of Michigan, and Penn State faced similar disruptions. Canvas, used by over 8,000 institutions and 30 million active users worldwide, serves as a critical tool for course management. ShinyHunters, known for targeting major corporations, previously claimed to have stolen 80 million records from Rockstar Games in April. The incident highlights the growing vulnerability of educational platforms to cyber threats.

ShinyHunters Hacking Group Targets Major Organizations, Including Education Sector The cybercriminal group ShinyHunters, named after the rare "Shiny" Pokémon sought after by players, has emerged as a significant threat since 2020. According to threat intelligence from Ransomware.live, the group has compromised 104 victims across 14 countries, stealing trillions of records. The majority of attacks 73 incidents have targeted U.S.-based organizations, including high-profile names such as Microsoft, Ticketmaster, Google, Cisco, AT&T, McDonald’s, Disney/Hulu, Harvard, and Princeton. One of the group’s most disruptive attacks involved Instructure’s Canvas Learning Management System (LMS), which serves educational institutions. The breach exploited a vulnerability in the Free for Teacher environment, a no-cost version of Canvas that allows independent educators to manage classes. Following the attack, Instructure temporarily disabled the service while conducting a security review. The incident highlights broader risks posed by centralized digital ecosystems and third-party dependencies, demonstrating how modern extortion operations can disrupt critical sectors even beyond education. While technical details remain limited, the attack underscores the growing threat of sophisticated cybercriminal groups targeting both corporate and institutional infrastructure.