The hacking collective ShinyHunters says it disrupted a major education platform not once but twice over the past few weeks. And the data breach could not have come at a worse time for students and teachers. These events unfurled during school finals at many of the affected institutions.

On April 30, Instructure, the edtech company behind Canvas, the popular Learning Management System (LMS) utilized by educational institutions around the world, temporarily went offline. A day later, Instructure confirmed that a "criminal threat actor" was behind a data breach into the company's systems.

According to ShinyHunters, the group stole data from 275 million Canvas users at nearly 9,000 schools worldwide. The affected users include students, teachers, and staff, and while no passwords or other sensitive data were taken, the data stolen was significant. The hackers claimed usernames, email addresses, student IDs, and private messages exchanged on the platform were part of the stolen data. Some of the impacted users are underage students.

Mashable 101 Fan Fave: Vote for your favorite creator today!

Shortly after the hack, Instructure confirmed that it had revoked access from the bad actors, took measures to fix the issues and prevent another breach from occurring, and brought Canvas back online.

However, just one week later, ShinyHunters says it hit Canvas again. This time, the hackers compromised school-specific login pages for the platform and defaced the pages with messages threatening to publicly release the stolen data from the previous breach unless Instructure agreed to "negotiate a settlement."

A monetary demand from ShinyHunters was not surprising. The ransomware group is known for extorting victims following a data breach. A second breach at Instructure, however, was a surprise. Canvas once again went offline, and when it came back, the company had removed the source of the second incident: Free-For-Teacher accounts.

According to a newly updated incident page on Instructure's website, the company says it "identified a vulnerability regarding support tickets in our Free for Teacher environment that was exploited." 

"We temporarily disabled Free for Teacher while we complete a full security review," the company said. "We know that's disruptive, and we didn't make that call lightly. But keeping the entire Canvas platform secure has to come first."

While the second breach did not result in any stolen data, the timing of the security incident could not have been worse for students, as many schools are currently holding finals and other scheduled deadlines for end-of-year coursework.

As PCMag reports, "students and professors struggled to access the online platform used to submit assignments and tests." (Disclosure: PCMag and Mashable are both owned by the same parent company, Ziff Davis.)

According to data provided to Mashable from Alliance Risk Trends, Google searches for "canvas hacked" and "canvas down" spiked roughly 1,000 percent just this past Friday. There was a combined search volume of more than 1 million for searches involving the Canvas security incidents and subsequent downtime.

Some readers reached out to Mashable to share their experience. One parent of a student at Seton Hall University forwarded Mashable an email that the school sent out while Canvas was down.

"We know the timing of this is hard," the school's email to students read. "Finals are underway, coursework is due, and Canvas being offline right now is genuinely disruptive."

Some schools, such as Bayton University in Texas, postponed final exams on Friday specifically due to issues accessing Canvas.

"With Canvas down at the national level, Baylor University will delay final exams tomorrow (Friday, May 8, 2026)," the school said in a statement.

Canvas is now back online. However, ShinyHunters' "settlement" deadline to release the data on May 12 still looms.

Want to learn more about getting the best out of your tech? Sign up for Mashable's Top Stories and Deals newsletters today.