Canvas was shut down by a threat actor group known as the Shinyhunters on May 7, around 4 p.m., leaving multiple universities, including the entire SLU community, without access.
While SLU was not the specific target of the attack, Shinyhunters recommended that affected institutions, SLU included, contact a cyber advisory firm to negotiate with them. Shinyhunters also breached Instructure around May 1, 2026, and stole information such as users’ names, student IDs, email addresses and private messages. According to the cybersecurity platform Bugcrowd, the group “became prominent in 2020 with their purported data theft of 200+ million records stolen from 13 companies.”
“Shinyhunters has breached Instructure (again). Instead of contacting us to resolve it, they ignored us and did some ‘security patches,’” the group said in the warning they sent to targeted schools, claiming responsibility for the attack.
The Shinyhunters demanded that Instructure pay a ransom by May 12 and also requested that affected institutions contact them privately before then to reach a settlement.
SLU’s Department of Operations and IT Management instructor Tracy Granneman said she is unsure about the potential impact of the hack.
“We know our availability has been impacted; we don’t know yet the extent to which there is an impact to confidentiality and integrity of data, if at all,” Granneman said. “I am confident that our SLU IT leadership is doing all they can to address this issue, especially when considering the nationwide scale of impact.”
“My main concern is getting grading done and having access to my gradebook,” Granneman said.
Provost Mike Lewis addressed the outage in an email sent to the SLU community at 9:52 p.m. The email told faculty to inform students about the outage and any possible adaptations to be made and told students to not access Canvas until the issue is resolved. Lewis also said that the final grade deadline for instructors or the institution as a whole may be extended if the issue isn’t resolved soon.
“We will work together to ensure courses and grading are able to be completed with integrity as we move forward,” Lewis said in the email.
Granneman said that students and faculty should be aware that hacks like this can happen and to be
prepared for them.
“I encourage everyone to follow the guidance provided by our CIO’s office and be careful of phishing or other activities that may increase due to this situation,” Granneman said. “Additionally, as this is the second outage to Canvas in two years (for different reasons), it is a good reminder to all of us to have our own contingency plans.”
The ransomware attack has affected other universities such as Duke University, the University of Pennsylvania and the University of Wisconsin- Madison, which have also lost access to Canvas.
Vice President and Chief Information Officer Kyle Collins sent an email to all SLU staff, students and faculty at 5:49 p.m. in response to the breach.
“Prior to today’s outage, we have also been looking into the recent reported security incident affecting Instructure, the vendor that provides the Canvas platform. That incident occurred within Instructure’s systems, not SLU-managed systems, and was not targeted at our university,” Collins said in the email.
“We recognize the impact of this outage, particularly at this time of the semester. We are actively monitoring the situation and will provide an update as soon as one is available,” Collins said in the email.
This is a developing story. This story will be updated as more information becomes available.
