A cybercrime group has actively targeted Canvas, the learning management system used by thousands of U.S. schools and universities, demanding ransom in exchange for stolen data affecting approximately 275 million students and faculty members. The attackers defaced Canvas login pages with extortion messages, disrupting classroom access and coursework submission across multiple institutions nationwide.

Canvas serves nearly 9,000 educational organizations, making the platform a high-value target for threat actors seeking maximum leverage. The breach compromised personal and academic records spanning students and staff across primary schools, secondary institutions, and higher education facilities. The scale of the attack—affecting a quarter billion individuals—represents one of the largest education sector incidents in recent years.

The defacement strategy signals a deliberate effort to maximize pressure on institutional victims. By publicly displaying ransom demands on login pages, attackers force organizations to confront the breach immediately while students and parents witness service outages firsthand. This approach combines operational disruption with reputational damage, increasing institutional incentive to negotiate.

Canvas parent company Instructure has not yet released official statements on the attack's technical origin, the specific CVE exploited, or recovery timelines. Educational institutions relying on Canvas faced immediate decisions: negotiate with attackers, attempt recovery from backups, or coordinate with federal law enforcement including the FBI and CISA.

The incident exposes critical infrastructure vulnerabilities within education technology. Learning management systems handle sensitive personally identifiable information, grades, and institutional data. A single compromised platform creates cascading effects across entire school districts and university systems, affecting operational continuity and student privacy simultaneously.

Organizations using Canvas should verify account security settings, monitor for unauthorized access, and preserve forensic evidence. Students should monitor for phishing attempts and credential theft targeting education accounts. Schools should prepare incident response protocols and establish communication channels with parents regarding data exposure risks.

THE TAKEAWAY: Education sector attacks targeting centralized platforms