Note: On May 8, after the time of this publication, the university’s information technologies department (UDIT) announced in an email that “Canvas service has been restored,” and that “there is no indication that University systems were compromised.”

On May 7, shortly after 4 p.m., the university’s Canvas page crashed due to a cybercrime group, ShinyHunters. The group hacked into Instructure, the creator and holder of Canvas learning systems. The hackers left a message regarding the nature of the attack and threatened to release students’ private information.

“If any schools in the affected list are interested in preventing the release of their data, please consult with a cyber advisory firm and contact us privately at TOX to negotiate a settlement,” the message read. “You have till the end of the day by 12 May 2026 before everything is leaked.”

ShinyHunters has been active since 2019, becoming known for its large-scale data breaches.

Canvas has since removed the message from ShinyHunters, uploading its own statement that the website and app are under scheduled maintenance and that users should check back soon. 

In a statement provided to The Review, the university described the incident.

“We are aware of an unauthorized message appearing in Canvas tied to a nationwide cyber incident affecting Instructure, the company that operates Canvas,” the statement read. “The university will share further guidance and updates with the campus community when available.”

The university is one of thousands of educational institutions worldwide affected by this breach. Within the past week, many schools, including the University of Pennsylvania, Harvard and Oxford have been impacted. 

The Daily Pennsylvanian reported that “ShinyHunters claimed responsibility for breaching Instructure on May 3, reportedly compromising the data of hundreds of millions of users, including 306,000 Penn affiliates.”

The University of Pennsylvania was previously targeted by this group in the fall of 2025, when it released a variety of the school’s internal files.

“In February, a ShinyHunters spokesperson told the DP that Penn failed to pay a $1 million ransom to prevent the further release of stolen files,” the Daily Pennsylvanian reported.

At 5:00 p.m., the university’s information technologies department (UDIT) sent out an email stating that they are “aware of a reported security incident involving Canvas” and that UDIT is working to investigate and solve the issue with the vendor. 

They state that the incident did “not originate from University systems.”

While students and faculty wait for the site’s return, the university provided an additional site where the status of the investigation will be updated.

This website states that the university has been aware of the cybersecurity incident since May 1, and that the information at risk includes “names, email addresses, student ID numbers and messages among users.”

They urge students to be aware of phishing emails and to check for any further updates from the university.