By Paige Trendell

The University of Maryland’s Enterprise Learning Management System Canvas was hacked after a group breached its parent system and educational technology company, Instructure, this afternoon.  

At around 4 p.m. on Thursday, students using Canvas received a message from ShinyHunters claiming that they had hacked into the system. ShinyHunters emerged in 2020 and has hacked companies such as Microsoft, GitHub, AT&T and PowerSchool. 

When logging into Canvas, students reported on social media that they were brought to a different login page. This could potentially be a password phishing scam, so students should not enter their login information. 

The university sent an email to students at 5:18 p.m. stating that Canvas is unavailable. A message on the Division of Information Technology website said that the university did not know when Canvas will be operational. 

Instructure is posting updates on this website. As of Thursday night, the status page stated that Canvas was available for most users.

Waters was in class when the hack occurred. She said her class was confused at first, especially since the university had not sent anything out to students. 

“I feel like it probably would have been better if they sent something earlier…telling everyone what occured,” she said. 

This hack comes at an important time, as many UMD students are completing final assignments and studying for exams.

“I have a lot of work to do,” said junior anthropology major Ruby Waters. “I’m happy that I didn’t have anything dire that had to be completed.”

Sophomore information science major Jolina Dang decided to take a break when Canvas stopped working. 

“I just took it as a sign to take the rest of my day to relax and not do any work,” she said. 

ShinyHunters claim the breach is a result of Instructure not contacting them after they hacked the system earlier this week, according to the Canvas message.

“If any of the schools in the affected list are interested in preventing the release of their data, please consult with a cyber advisory firm and contact us privately at TOX to negotiate a settlement,” the Canvas message said. 

All institutions that use Canvas were affected, according to the Division of I.T. website. The security breach impacted 9,000 schools, including the University of Baltimore and Howard Community College.

ShinyHunters’ message also said Instructure has until the end of Tuesday to contact the organization.  

According to Inside Higher Ed, ShinyHunters wrote a ransom letter to Instructure on May 3.   

The ransom letter said that data leaked would be “several billions of private messages among students and teachers and students and other students involved, containing personal conversations and other [personal identifying information].”

The letter also included the statement “PAY OR LEAK,” but it is unclear the amount of money the group is demanding. 

Junior computer science and mathematics double-major Jonathan Kraft was surprised that the attack occurred. 

“They have professors who are actively researching how to make better defenses against this kind of stuff,” he said. “They should be not immune to it, but better defended against it.”

The University of Maryland Division of IT did not immediately respond to request for comment. 

Featured Image: A message indicates that Canvas cannot be used after a data breach on May 7, 2026. Screenshot via Canvas.

Editor’s Note: This article was last updated on May 7, 2026.