Hacker deadline looms as some universities regain Canvas access

Tens of thousands of students were last week caught up in an incident of cybercrime relating to online learning management system Canvas. (Reuters: Samantha Sais) Australian universities and education departments have started regaining access to the online learning management system Canvas, following a global outage last week. Other education institutions are still unable to use the platform, impacting the ability of students to access learning materials and submit assignments. The hacking group behind the incident has warned it will leak the compromised information unless a settlement is negotiated by the end of Tuesday. Link copiedShareShare articleThe cloud-based learning platform Canvas is back online for some Australian schools and universities, though the deadline set by a cybercriminal group is still looming. Thousands of educational institutions around the world were left scrambling last week after online hacking group ShinyHunters breached the platform. As a result of the cybersecurity incident, the system was taken down for many institutions on Friday, resulting in cancelled classes and postponed exams. Hundreds of thousands of students have been unable to access schoolwork or submit assessments as access to Canvas has been paused. While some users across Australia were still unable to access the learning system on Monday, a number of major universities have had the system brought back online. This included the University of Sydney, which said access to Canvas had been "fully restored" over the weekend, meaning "teaching and learning can resume as planned". The University of Sydney says access to Canvas has been fully restored. (ABC News: Jak Rowland) In an online statement, it said assessment extensions and other supports would be put in place "to ensure fairness for all students". The system was also restored for students and staff at the University of Melbourne, according to an update published on the university's website this morning. Swinburne University was yet to restore access as of this morning. (ABC News: Jesse Thompson) Some of the universities yet to regain access included the Queensland University of Technology, the Royal Melbourne Institute of Technology, and Swinburne University. Many public and private schools from across the country were also still unable to access the learning management system. Students and staff at Tasmanian public schools have been advised by the Department for Children, Education and Young People that access to Canvas will be restored by tomorrow. Almost 9,000 institutions worldwide use the Canvas learning management system developed by Instructure, a company based in Salt Lake City in the United States. Canvas is a digital hub used by schools and universities for submitting assignments, taking exams, checking grades and communication between teachers and students. More than 500 data breaches were reported in Australia over the first half of 2025 alone, but there are some ways you can minimise your risk of being caught up in one. In an online statement last week, Instructure chief information security officer Steve Proud said the cybersecurity incident was perpetrated by a "criminal threat actor". He said early investigations suggested the compromised information included names, student IDs, email addresses and messages between users. Some students and teachers who logged in to Canvas last week were greeted with a message from cybercriminal group ShinyHunters, claiming responsibility for the breach. The message included a warning that the information would be leaked, unless institutions contacted ShinyHunters to "negotiate a settlement" by the end of May 12. The Australian Signals Directorate says people should never pay a ransom because there is no guarantee they will regain access to their information. (Unsplash: Taskin Ashiq) The response to the breach in Australia is being coordinated by the National Office of Cyber Security within the Department of Home Affairs. Australia's national cyber security coordinator, Michelle McGuinness, previously said she was working with state and territory governments and education peak bodies to address the impacts arising from the incident. The response to the breach in Australia is being coordinated by the National Office of Cyber Security, led by Michelle McGuinness. (ABC News: Peter Drought) "We are not aware of any personal identification documents or financial information being impacted by this incident," she said in a statement on social media. She urged people not to respond to unsolicited contact, as criminals use information from data breaches to attempt extortion. On its website, the Australian Signals Directorate warns people should never pay a ransom because there is no guarantee they will regain access to their information or prevent it from being leaked online, and they may be targeted in another attack. Instructure has been contacted for comment. Copy linkFacebookX (formerly

Hacker deadline looms as some universities regain Canvas access

Key takeaways

More in international