Canvas Cyberattack Disrupts Thousands of Schools During Finals

Cover image from chicago.suntimes.com, which was analyzed for this article
A ransomware attack disrupted Instructure's Canvas platform, used by thousands of schools, postponing finals and causing chaos during exams. Hackers claimed data theft from nearly 9,000 institutions; the system is recovering. The incident highlights vulnerabilities in educational tech infrastructure.
PoliticalOS
Friday, May 8, 2026 — Tech
The Canvas attack demonstrates how thoroughly educational institutions have outsourced core academic functions to a handful of cloud providers. When those providers are breached, the fallout lands directly on students and faculty at exam time, with stolen personal data creating future risks that extend far beyond postponed deadlines. Schools and parents should treat vendor security as seriously as curriculum quality; the convenience of digital platforms carries measurable fragility that this incident has now made visible.
What outlets missed
Three of the five provided outlets did not cover the Canvas attack at all, focusing instead on unrelated immigration enforcement, Supreme Court education precedents for immigrant children, and a French criminal probe into Elon Musk. Among those that did report it, key details were often downplayed: the precise claim of 3.65 terabytes of data stolen, the existence of a second distinct breach used specifically for login defacements, and Instructure's prior history with ShinyHunters. Few outlets examined the downstream risks of exposed student messages and IDs enabling spear-phishing campaigns weeks or months later. The broader pattern of ransomware groups targeting education during high-stakes periods such as finals received minimal exploration.
Republican Pressure Builds to Restrict Undocumented Children’s Access to Public Schools
A landmark Supreme Court ruling that has guaranteed public education to all children regardless of immigration status for more than four decades is facing its most serious challenge in years. As the Trump administration intensifies deportation operations and encourages self-deportation, Republican lawmakers and conservative activists are openly calling for states to test or overturn the 1982 decision in Plyler v. Doe, arguing that educating undocumented students drains resources from American children.
The Plyler ruling established that states cannot bar children from public schools based on their immigration status or that of their parents. Writing for the majority, Justice William Brennan described education as fundamental to breaking cycles of poverty and noted that children cannot be held responsible for their parents’ decisions. That principle has shaped American practice ever since. Yet rising enrollment of immigrant students, combined with tight school budgets and political polarization, has fueled a backlash.
Rep. Chip Roy, a Texas Republican also running for state attorney general, declared during a March congressional hearing that the ruling “has got to go.” He argued that “any amount of illegal immigration in our hospitals, jails, schools, or elsewhere should not be tolerated” and that states should have authority to curb it. Similar sentiments have appeared in state legislatures across the country. In the past year, lawmakers in several states introduced bills to collect data on students without legal status, charge tuition to undocumented families, or otherwise limit their access. None have passed so far, but advocates on both sides see them as deliberate efforts to create a test case that could reach a Supreme Court reshaped by recent appointments.
The debate arrives at a moment of heightened enforcement. The Trump administration has lifted previous restrictions on immigration arrests at or near schools and has moved to end protections for some lawfully present immigrants. Federal data analyzed by the Deportation Data Project shows that 580 people were detained in the Chicago area alone between January and mid-March. While the chaotic, highly visible raids of last fall—marked by masked agents, tear gas, and neighborhood sweeps—have quieted, enforcement has not stopped. It has simply become less theatrical.
That shift has forced community groups to adapt. In Chicago neighborhoods with large immigrant populations, rapid-response coalitions such as PUÑO in Pilsen have moved from reactive street monitoring to sustained training programs. Organizers now emphasize teaching residents their rights during everyday interactions with law enforcement, tracking patterns in arrests, and maintaining 24-hour readiness. Mimi Guiracocha, a lead organizer with PUÑO, described the current period as “the new normal” that could last years. “We just have to be always ready and always prepared,” she said.
Immigrant advocates warn that the combination of policy pressure and enforcement creates fear that keeps children out of school even when they are legally entitled to attend. Research has long shown that education is one of the most effective tools for reducing long-term poverty and aiding integration. Denying it, they argue, would create a permanent underclass at significant future cost to taxpayers. Critics counter that school districts, especially in border states and large urban systems, already struggle with overcrowding, teacher shortages, and limited funding. They say resources should prioritize citizens and legal residents.
The stakes for schools extend beyond policy. Educational technology systems that millions of American students rely on have proven vulnerable to attack. This week the hacking group ShinyHunters claimed responsibility for breaching Instructure, the company behind the widely used Canvas learning platform. The group says it stole data on 280 million records from roughly 8,800 schools and universities worldwide and has threatened to release it unless a settlement is reached by May 12. Several universities, including Harvard and the University of California, Irvine, saw login portals defaced with ransom messages. The breach raises fresh worries about the privacy of sensitive student information—including immigration status, addresses, and family details—that could be exploited in an environment of aggressive enforcement.
School administrators now navigate overlapping pressures: legal uncertainty about which students they must serve, community anxiety that discourages attendance, and the technical reality that the digital infrastructure supporting daily learning is not secure. The Plyler decision was grounded in a simple idea that punishing children for circumstances beyond their control is both ineffective and contrary to American values. Whether that idea survives today’s political and fiscal realities will likely be decided in courtrooms and statehouses in the coming years. For thousands of children whose only home is the United States, the outcome will shape their life chances in ways that extend far beyond the classroom.
You just read Liberal's take. Want to read what actually happened?
More in Technology

Pentagon Adds Alibaba, Baidu, BYD to Chinese Military Companies List
The Pentagon expanded its list of Chinese military-linked companies to include BYD, Alibaba, and Baidu, triggering new restrictions.

WWDC 2026 Previews Center on Siri Overhaul and AI Updates
Apple’s developer conference opened with keynotes on iOS, Siri, and Apple Intelligence advancements. Focus centered on new AI features and platform updates.

AI growth sparks verified risks and unverified backlash claims
AI's rapid growth raises concerns over extremism, power consumption, and education effects. Discussions include government role and corporate developments.

AI Agents Advance as Frontier Labs Face Investor Scrutiny
AI agents are positioned as the next major shift, with companies like Anthropic facing scrutiny over investors and new executive orders requiring government review of advanced models.