A comprehensive ransomware data breach of Charleston County School District’s (CCSD’s) infrastructure platform, Canvas, by hacking group ShinyHunters has placed the data of an alleged 275 million students at risk of release, according to the hacking group’s ransom note.
On Thursday, May 7, 2026, ShinyHunters, a ransomware-focused hacking group, shut down Canvas sites for nearly the entire afternoon, replacing the website’s front page with a ransom note.
Canvas, a very popular instruction and testing site, is used by nearly half of all educational institutions in the United States, and as a result, the hacking group claims to now possess data from 275 million people across 9,000 schools and institutions, as well as nine billion messages between students and teachers and 3.65 terabytes of raw data.
This attack struck during the heart of exam season, with some universities across the country pushing back deadlines, while many students panicked, losing their main hub for study sources during an exam week.
These hacks originally occurred on May 1, 2026, with Canvas experiencing “a cybersecurity incident perpetrated by a criminal threat actor,” according to CNN. Canvas said the breach had been “contained” within 24 hours, but that usernames, email addresses, student ID numbers and communications from some institutions appeared to have been exposed, according to CNN.
An Instructure spokesperson said to Reuters that the hackers used Canvas’ Free-for-Teacher service, which allows non-Canvas users limited access to the core site’s resources for testing.
ShinyHunters claimed responsibility for the attack on May 3, and set a deadline of May 6 for Canvas to respond. On the following day, May 7, ShinyHunters publicized a new deadline of May 12 for schools to negotiate a ransom payment with the group through the recent website shutdown and public-facing ransom note.
Canvas’ main site is back online after Instructure shut down the Canvas Free-for-Teacher site, with confidence that another breach is unlikely and leaks have been plugged. However, Canvas “Test” and “Beta” sites are still down for maintenance.
CCSD’s Canvas platform was also down on Thursday, May 7, as a result of the hack, and although students did not see the ransom letter, which appeared nationally, as CCSD data was not taken in the overall attack, students did see that Canvas was “down for scheduled maintenance” for the rest of the day.
CCSD has not responded to the Tribal Tribune for comment at this time.
