Extortion group breaches Canvas security, UTD among nearly 9,000 schools affected

May 13 | 2:00 p.m. As of May 11, ShinyHunters has destroyed all breached records after Instructure, Canvas’ parent corporation, paid the hackers’ ransom. The amount paid is unknown as of publication. 

---

Canvas, the platform UTD was planning to replace eLearning with in the fall, has been hacked by cybercrime group ShinyHunters. According to ShinyHunters, UTD and 8,808 other institutions have been compromised in a 3.65 terabyte data leak set to be released by the end of May 12 if ransoms are not paid.

This is the second such Canvas breach this month. On May 1, ShinyHunters hacked Canvas and claimed to have breached the data of 275 million individuals — leaked data included names, student identifiers, emails, private messages and assignments hosted on the platform. The scope of the data obtained by ShinyHunters in this second breach remains unclear. Instructure, Canvas’ parent company, confirmed the May 1 breach. 

The ransom message posted on Canvas’ login page instructed individual schools to reach out to the ransomers by the end of day May 12 to negotiate for their students’ and faculty’s data before it is leaked. As of publication, the login page now reports that “Canvas is currently undergoing scheduled maintenance.” While some Canvas-based schools are severely affected by the outage during finals season — CNN reported students across the country have been unable to access their grades or assignments — the outage will not affect finals or grades at UTD. 

UTD, being a tech-heavy school, is home to students concerned about data privacy and security in their day-to-day lives, like computer science freshman Yahya Elkady who said he is careful about his logins and passwords. He said universities are bound by laws like FERPA because they have a responsibility to ensure certain student information remains private. 

Names, addresses and emails are considered directory information under FERPA, which schools may make public, while grades and disciplinary records are non-directory information only disclosable to others with the student’s written consent. It is currently unclear how much, if any, non-directory information from UTD has been revealed in the Canvas breach.

Celina Rodriguez, a computer science junior and Women in Cybersecurity President, said that from what she had seen, other universities had Canvas message chains, names, emails and student IDs as part of the breached information, but because UTD has not started officially using Canvas for courses, it is unlikely the UTD breach is as large as that of other schools.

“The real question here is just how much data UTD has already transferred onto Canvas for us to be listed on the ransom note,” Rodriguez said. “If it’s FERPA-related or [personally identifiable information], then I think it would be right for students to be on alert. I don’t think we are at risk of any messages being leaked since we haven’t made the full switch yet, but netIDs, emails and other user info might have been stolen if UTD already started setting up accounts.”

While students were initially supportive of the transition to Canvas, some, including biomedical sciences sophomore Wesley Phillips, are now worried about the safety of their data.

“There is the capacity for there to be super sensitive personal information leaked,” Phillips said. “I would definitely want us to avoid that.”

Meanwhile, Elkady said he believes the breach can teach UTD and Canvas useful lessons about data security.

“I think it’s good for them to know what happened so they can fix it so [when] we actually migrate fully to Canvas and everyone’s using it, that won’t happen again,” he said. “A platform like Canvas wouldn’t have as much private data for students as other important platforms, but [a breach] should never happen after fully migrating. I don’t think anything like that should ever happen, so I think it’s good that it happened now before migrating while they’re testing.”

Rodriguez said that once information starts getting leaked en masse, particularly around the May 12 ransom deadline, students should check to see if things like their passwords are leaked. 

“Changing your passwords after something like this is just basic cyber hygiene which can mitigate possible damage,” she said.

Most UT System schools, as well as Texas Tech and Texas A&M, were hit by the attack, along with the Texas Education Agency, which is responsible for K-12 public education in the state. Top U.S. private schools like Harvard University and MIT; private companies like McGraw-Hill, Amazon and Apple; public school districts; and universities in other countries like Universidad Autónoma de Guadalajara in Mexico, Universidad Católica de Murcia in Spain and Lovisenberg Diakonale Høgskole in Norway have been affected as well. 

ShinyHunters was founded in 2019, according to the group’s website. It has hacked educational institutions in the past, including McGraw-Hill in April and Harvard and the University of Pennsylvania in 2025. The Daily Pennsylvanian, the student paper at UPenn, wrote that ShinyHunters reached out to UPenn May 3 with their threat to leak data May 8 unless a ransom was paid. The group has also previously hacked Google, the European Commission and Microsoft in 2026, 2025 and 2020 respectively. 

ShinyHunters has not clarified how long it has allegedly possessed the information it is threatening to leak. It is also unclear whether every affected institution had its Canvas data breached or experienced some other type of breach.
The Retrograde has contacted the Office of Communications about any details UTD can share regarding the impact of the data breach. The office has not responded as of publication.

This is a breaking news story. The Retrograde will provide additional coverage as details emerge.