Massive Cyberattack on Peninsula College's Canvas Platform

Peninsula College students attempting to log into their online classes this afternoon were initially met with a seemingly benign message: a graphic of a rocket ship and robots, accompanied by the words, “Canvas is currently undergoing scheduled maintenance.”

Now, a more urgent banner spans the college’s website: “Canvas is currently unavailable globally. There is no estimated time for restoration at this time. We’ll share updates as soon as we receive them.”

Behind this outage lies one of the largest educational cyberattacks in history.

Instructure, the parent company of the widely used Canvas learning management system, has been breached by the criminal extortion group ShinyHunters.

The hackers allege they have stolen 275 million records and over 3.65 terabytes of data, affecting an estimated 8,809 school districts, universities, and online education platforms worldwide.

For Clallam County, this means the personal data and private communications of Peninsula College’s student body and faculty are potentially in the hands of cybercriminals. While the college’s portal remains locked down, the reality of the situation is far more urgent.

On a dark web leak site, ShinyHunters posted a ransom note asserting they have breached Instructure “(again)” and mocking the company for ignoring them to do “security patches.”

The group has issued a stark ultimatum, giving Instructure and affected schools until the end of the day on May 12, 2026, to negotiate a settlement.

A failure to pay, the hackers warned, could result in the release of “several billions of private messages among students and teachers.”

The possible exposure of Canvas data is particularly alarming due to the platform’s central role in student life.

According to a disclosure Instructure sent to affected institutions, the company stated there is currently no evidence that passwords, government identifiers, dates of birth, or financial information were taken.

However, Instructure confirmed in the same disclosure that full names, email addresses, student ID numbers, and private messages were accessed before the breach was contained.

At Peninsula College and institutions nationwide, these private messages often contain highly sensitive disclosures to academic advisers, academic accommodation requests, and communications with Title IX advocates.

Canvas is an educational juggernaut, used by 41% of higher education institutions in North America.

The current breach is Instructure’s second confirmed cyberattack in just eight months, following a previous ShinyHunters attack against the company’s Salesforce environment in September 2025.

As the May 12 deadline approaches, Instructure has engaged outside forensic cybersecurity experts and law enforcement.

The full scope of the breach is still under investigation. In the meantime, Peninsula College students and staff in Clallam County are advised to remain vigilant.

Cybersecurity officials recommend monitoring accounts for unusual activity and treating any unsolicited emails or password reset requests purportedly from Canvas with extreme caution.