On May 7, students opened Canvas expecting to work on revision or coursework, only to find an ominous threat from a hacker group instead of the website’s homepage.
Zyra Batool, a first-year Japanese Studies undergraduate, was one of the students affected:
“I wanted to submit a piece of work [that] counted towards my final grade, and Canvas would not let me. I had to call IT services after midnight, a few hours before my deadline, and they told me it was an issue for every university that used Canvas.”
“Luckily, my teachers were really understanding about it and let the whole course know what was going on, and what alternative steps to take if we had a deadline during the time of the attack”.
The group behind the attack was ‘ShinyHunters’, an “extortion group” that has targeted Canvas twice before. The hackers used ransomware, a type of malware, to lock the website behind an encryption key only they have access to, then demanded payment for the data to be released and not be sold.
In this case, ShinyHunters required a settlement from Canvas’s parent company, Instructure, for the data to be returned. Instructure negotiated, freeing 3.5 terabytes of data. The amount they settled for was never disclosed, but Luke Irwin, an Aegis cybersecurity expert, estimated the demand could have been as high as $10 million.
Canvas was experiencing issues as early as May 4, with two emails being sent to students the day after. One ensured that the University was aware of the attack, and the second, which came a few hours later, said that the issue was “localised rather than widespread” and reassured that students still affected would not be “disadvantaged or penalised”.
The issue was addressed again by the University on May 6, where they confirmed that “data associated with the University of Manchester has been accessed” and it may include “names, email addresses and user identification numbers [but] not believed to include sensitive personal data such as dates of birth, financial information or passwords.”
Infrastructure had “confirmed that the incident is contained at their level and the system is operating under enhanced security monitoring”.
A day after the attack on May 8, a final email was sent out summarising what had happened, reiterating which data had been stolen, and stating that Canvas and relevant parties were handling the situation.
The University of Manchester has seen cyber-attacks before, with the most recent being a data breach in 2023 that “copied” a “small proportion of data that relates to some students, and some alumni”.
Malware-related attacks in higher education are more prevalent than ever. According to the government website, 98% of higher education institutions “had identified breaches or attacks in the last 12 months” for the 2025/2026 year.
The University Cyber Security team has a 24/7 support centre where security incidents can be reported immediately via their designated telephone line.
