ShinyHunters Ransom Note Shuts Down Canvas LMS Worldwide

Ransomware crews have targeted educational software before—WannaCry crippled the UK’s National Health Service and dozens of universities in May 2017, while the January 2025 PowerSchool extortion attempt similarly dangled student data—but this is the first time a single cloud LMS with a global 30-million user base has been knocked offline in unison. The episode underscores two long-running dynamics: (1) the monopolistic consolidation of critical campus functions into a handful of SaaS vendors, and (2) the professionalisation of data-theft-then-ransom tactics that commoditise stolen records rather than simply encrypt files. If higher education continues centralising teaching infrastructure without diversified backups, every finals season could inherit the systemic fragility we now associate with energy or food supply chains. Over a 100-year horizon, this breach will be a footnote unless it catalyses a shift toward federated, open-source or on-prem alternatives; if not, it may mark the moment the academy’s dependence on opaque commercial platforms became irreversible.