When the ransom note was posted on a Chicago student newspaper's homepage, the message was almost bureaucratic: negotiate privately, avoid a data release. The recipients were the University of Chicago, Penn State, UCLA, the University of Toronto, the University of British Columbia, and the University of Sydney, among roughly 9,000 institutions around the world. The software they all had in common was Canvas, the learning management system owned by the Utah-based company Instructure. By late Thursday, most users were back online. The message the attack sent will not be.
The hacking collective ShinyHunters, which has spent the past two years accumulating one of the largest known private repositories of stolen credentials, reportedly claimed responsibility. Screenshots circulated by the threat analyst Luke Connolly of Emsisoft show the extortion campaign began on Sunday and set deadlines for Thursday and May 12.
Timing that was not an accident
The attack landed in the last week of North American semesters and the middle of the Australian one. Penn State cancelled exams. Sydney told students not to log in. UCLA students struggled to submit coursework. The academic calendar is the softest possible target: maximum student panic, maximum institutional pressure to pay, minimum time for a technical recovery.
Schumer's letter
On the same day Canvas went dark, Senate Majority Leader Chuck Schumer sent a formal letter to the Trump administration demanding that the Department of Homeland Security "immediately help states and localities" harden their defenses. His framing was explicit: the arrival of large-scale generative AI has collapsed the cost of offensive cyber operations while the public sector's defensive posture has not meaningfully improved. Schumer's warning is not speculative. Canvas is the evidence.
The supply-chain point
Instructure is not a government contractor or a defense firm. It is a private company that happens to sit inside the workflow of a tenth of the world's higher-education institutions. That is the new attack surface. The twenty-first-century equivalent of attacking a power grid is attacking the SaaS vendor that 9,000 customers share. Downstream damage cascades automatically.
Our take
Education systems make a useful canary: networked, under-resourced, and under genuine time pressure. Thursday's outage showed how cleanly a modern ransomware crew can paralyze a critical civilian workflow through a single SaaS chokepoint. Schumer's letter is correct. The policy response is not.
