Colleges from the US to Australia reported disruptions to a popular online portal used by students at thousands of institutions to take tests and receive grades, days after a cyberattack against its operator.

Instructure Inc., which runs the Canvas online learning portal, first disclosed “a cybersecurity incident perpetrated by a criminal threat actor” on May 1, according to a post on the company’s website.

The firm announced that Canvas was fully operational on Wednesday, but a day later, Instructure placed the platform in maintenance mode, saying only that it anticipated “being up soon.” Instructure did not immediately respond to a request for comment outside of normal business hours.

College students use Canvas for everything from accessing course materials and turning in assignments to checking grades and taking tests. Schools around the world — from Stanford University in California to the University of Oslo in Norway and Australia’s Adelaide University — reported problems with the portals. Yale University, Columbia University and Princeton University also experienced issues.

Opportunistic hackers have for years found schools to be easy targets, but universities have been especially hard-hit in recent months. Last year, a series of hacks at Ivy League schools including Harvard University, Princeton and the University of Pennsylvania exposed the information of alumni, donors and students.

Following the latest breach at Instructure, some colleges warned that student information might’ve been accessed as part of the hack. Yale said on its website that the incident involved unauthorized access to user data in Canvas, potentially including names, email addresses and messages sent through the system. 

Stanford said certain identifying information including names, email addresses, student identification numbers and messages between users might’ve been compromised. 

Rutgers University said in a statement that it was unclear what school data may have been compromised. Baylor University warned students of phishing messages that may aim to steal their information from attackers impersonating the school’s IT staff.  

A Duke University security spokesperson confirmed the incident and said the school is “closely monitoring the incident,” according to the student publication there.

A prolific cybercrime group, ShinyHunters, said it was responsible for the hack in a dark web post seen by Bloomberg News, but Instructure hasn’t confirmed that the group was behind an attack. ShinyHunters is known for stealing victims’ data and then demanding extortion fees.

In 2024, the buyout firm KKR & Co. agreed to buy Instructure in a deal that valued the Salt Lake City-based company at about $4.8 billion including debt. The company was founded in 2008 and was majority-owned by the private equity firm Thoma Bravo before KKR’s takeover.

More stories like this are available on bloomberg.com

Published on May 8, 2026