ShinyHunters—a hacking group linked to the cybercrime network UNC6040—is believed to be behind a widespread breach of Instructure’s systems. The group reportedly accessed the platform through Canvas on April 29, compromising more than 8,000 schools and threatening to release millions of sensitive records by May 12. 

The attack escalated on May 7, when Canvas-Instructure login pages were defaced with a ransom demand, forcing the system offline during finals week at many universities.

The breach may be connected to a September 2025 phishing attack on Instructure’s Salesforce system using similar techniques that exposed business contact information but not student records.

The global cyberattack disrupted Canvas, causing a “forced break” for thousands of students. Although Instructure agreed to pay a ransom to the ShinyHunters and the situation was resolved within days, several students from different campuses expressed indifference, regardless of whether their academic records or data were altered or stolen.

The incident has caused students to get behind on several assignments, lose contact with professors and miss Zoom classes.

Cambria Peverley, a UC Riverside student majoring in linguistics, said the shutdown set her back on several assignments, and she had a midterm. There was also no way for her to contact her professor, and she mentioned you’d be “kind of screwed” if you didn’t have your connections in place with other students and the emails of professors. 

“I’m so screwed. I didn’t care anymore. Honestly, it gave me a break to chill, and now I’m stressed. It’s a trade-off,” Peverley said.

Peverley said she wasn’t that concerned and added: “They were going after money that wasn’t our money. I guess it’s our data, but like, big companies use our data anyway, all the time.”

Tasiolofa Washington, a UC San Diego student majoring in digital art, said only her ability to attend class was impacted, but not assignments, since she didn’t have any. Yet she said she was emotionally impacted because she thought “she was free” since it only lasted three days.

“I thought they got it forever. I thought they did a good job, but they didn’t,” Washington said regarding the ShinyHunters. 

However, she said didn’t really care about hackers having her information and that “the most they could get is my grades.” But if they got her personal data, like her social security number, she said: “Well, China can too. Everyone already got my Social Security at this point. It’s fine,” said Washington.

Jaron Simmons, a Grossmont student majoring in studio arts, said he was able to take advantage of the situation even though there were downsides to not being able to contact professors. 

“I had a mix of reactions because there was a hint of anxiety in me, but I had a feeling that I was fine if I didn’t use the site, and I was a little relieved because I was a little behind on certain things. So I kind of wanted to take advantage of the situation,” Simmons said.

Although several students said they did not fully understand what happened, many were not deeply concerned because of the convenient timing of finishing assignments and teachers being “on the same boat,” giving extensions. Several students explained why they still trust Canvas.

Jayson Alvarado, a Grossmont student majoring in film production, said, “I’m just going to trust it won’t happen again. I still trust Canvas, I mean, cause they couldn’t really predict this. I feel like I’m forced to, regardless, because it’s college stuff,” Alvarado said. 

He also did not mind the situation, since he said he had finished all his homework by the time it happened and had little worry that it would hurt him somehow.

Similarly, Simmons said, “I trust them out of this, out of default, because I use them, and I have to. I’m mostly an online student, you know. I hope this doesn’t happen again soon. I think it’s important to let Canvas know to shape up a little bit.”

Peverley said cyber incidents are a regular part of today’s digital world. Since it’s a cyber world, “these things are going to happen all the time,” she said, adding that many attempts likely fail. While she described the situation as more interesting than alarming, she said she does not plan to dwell on it. 

“Out of all the things that could go wrong, this isn’t that bad,” she said. “Maybe if someone had a heart attack over their grade.”

Several students expressed disapproval with what the hackers did, while some commended it instead. Many of these students speculated that the hacker’s motives were money or building a reputation for power.

Simmons said that the situation is “very complicated” and “super unjustified” since it affected everybody, and explained:

“We live in hard times, but to me, this feels less about someone acting out in desperation and more about someone utilizing their gifted abilities for selfish reasons.”

In addition, Simmons explained that since they got what they wanted, it’s apparent that it’s about greed, power and control. “And that’s scary because we are already dealing with so much of that from people who don’t even have to hide their identities. I think it’s very unjustifiable because there are so many of us struggling right now.”

Peverley said she kind of liked how hackers got into it because it “sticks it to the big man that controls everything” and questioned why one person controls all her grades.

“I like learning, but I don’t like that it is so centralized to one place. There should be other places to compete so that it remains competitive. It shouldn’t monopolize education.”

She commended them because, since there are so few groups of people with so much power and money, “that you have to get creative ways to get part of that money” and that “it takes a lot of guts.”

“I was kind of happy when I heard the news. At least someone’s using their bands for things. They’re not like letting all the rich people run a mug. Make rich people work, you know? I’m talking about people making millions or billions. Make them work for it,” Peverley said. 

Washington also thought it was good in a way that they got paid. She said that since they did it the first time, they “could do it better this time” to make it last longer, making them “pay more money so that we don’t get Canvas back.” 

Several students said they were glad that no one was physically hurt, which helped explain why they weren’t more worried.

ShinyHunters was formed as early as 2019, and despite previous arrests of certain members, ShinyHunters remains active following the Canvas and Instructure breach and has been linked to other cybercrime networks, including “Scattered Spider” and “The Com” (The Community), an international hacking community.  The group has not publicly stated a clear motive, leaving questions about whether there was intentional timing behind targeting Canvas during finals week.