Harvard Canvas Site Goes Down After University Listed in Instructure Breach

Updated May 8, 2026, at 1:31 p.m.

Harvard students temporarily lost access to Canvas on Thursday afternoon after the cybercriminal group ShinyHunters listed the University among thousands of schools allegedly affected by a breach of Instructure, Canvas’ parent company.

Canvas, which Harvard uses to host course websites, assignments, readings, and messages between students and instructors, remained accessible to Harvard affiliates through at least 2 p.m. Thursday.

Around 3:30 p.m., the site began redirecting users to a message from ShinyHunters, a notorious cybercriminal group that claimed it had “breached Instructure” and posted a list of affected schools.

By around 4:20 p.m., the site had been updated to display a message that read, “Canvas is currently undergoing scheduled maintenance. Check back soon.”

Both the Canvas mobile app and the web platform remained inaccessible to Harvard users through Thursday evening before access was restored around 2 a.m. Friday.

The shutdown came on the first day of the spring final exam period, leaving some students scrambling to access course resources as they continued preparing for exams. Some professors released study materials to students by email during the outage.

Harvard has not announced any changes to its final exam schedule as a result of the outage. Panopto, the platform that stores Harvard College lecture recordings, remained operational, though many students typically access recordings through Canvas.

The message posted Thursday claimed the group had breached Instructure “again” and accused the company of ignoring its outreach by issuing small “security patches.” It urged schools included on the affected list to consult with a cyber advisory firm and contact the group privately to negotiate a settlement before the end of the day on May 12 — or else risk their data being leaked.

It remains unclear what information tied to Harvard affiliates was included in the alleged breach.

Harvard University Information Technology spokesperson Tim Bailey wrote in a statement Thursday that the University was “aware that the Canvas platform is currently unavailable due to a cyber incident.”

Bailey said HUIT was “actively investigating” the breach and would update its status page with any new information.

ShinyHunters first announced a breach of Instructure Sunday, claiming to have stolen data — including billions of private messages containing “personal conversations” — from 275 million affiliates across 9,000 schools.

At the time, the group gave Instructure and affected schools a May 6 deadline to respond to their demands.

Bailey did not immediately confirm whether Harvard was included in the initial list, but the University was named in a document released by ShinyHunters listing allegedly affected schools.

In February, ShinyHunters leaked datasets that it claimed contained more than 1 million records from Harvard, including personal information and donation data. The group claimed the records were obtained during a November breach of information systems used by Harvard’s Alumni Affairs and Development Office.

Harvard confirmed that a breach occurred in November. In an email at the time, Chief Information Officer Klara Jelinkova and Alumni Affairs and Development chief James J. Husson wrote that data impacted by the breach included information about donations to Harvard, event attendance records, email addresses, telephone numbers, and home addresses.

—Staff writer Sebastian B. Connolly can be reached at [email protected] or on Signal at sbc.23. Follow him on X @SebastianC4784.

—Staff writer Summer E. Rose can be reached at [email protected] or on Signal at ser.85. Follow her on X @summerellenrose.