Final Incident Summary
What Happened
On May 1, Instructure — the company that operates Canvas — identified a cybersecurity incident carried out by a criminal hacking group known as ShinyHunters. The group gained unauthorized access to Instructure’s systems and demanded a ransom to prevent the release of stolen data. On May 7, 2026, Instructure identified additional unauthorized activity tied to the same incident. The unauthorized actor made changes to the pages displayed when some students and teachers were logged in via Canvas.
As a precaution, VCCS proactively shut down access to Canvas. On Thursday, May 7 at approximately 4:45 p.m., Instructure took the additional step of shutting down Canvas entirely for all users nationwide to contain the activity, investigate, and apply additional safeguards. Canvas was restored this morning (Friday, May 9) and VCCS faculty and students regained full access just before 9:30 a.m.
What Data May Have Been Compromised
According to Instructure, the following information may have been affected:
- Names
- Email addresses
- Student ID numbers
- Messages between users within Canvas
Importantly, Instructure has confirmed there is no indication that passwords, dates of birth, Social Security numbers, or financial information were compromised. Faculty and students are encouraged to be vigilant around unsolicited emails or messages.
Third-Party Integrations
Some third-party tools integrated with Canvas (such as publisher and vendor content) are not yet fully restored. Out of an abundance of caution, vendors have temporarily disabled their Canvas integrations. Over the next 24 hours, vendors are expected to restore access following their own security reviews.
Status Update May 8, 2026 at 9 a.m.
Canvas access has been restored. Users may experience temporary delays or intermittent issues as systems continue to stabilize.
The myVCCS portal Canvas tile is also functioning normally again.
Continue to avoid suspicious links or files related to Canvas.
Thank you for your patience as we worked through this issue.
Status Update May 8, 2026 at 7 a.m.
VCCS ITS is currently validating Canvas status within the VCCS environment and confirming secure operation with our Single Sign-On (SSO) integration.
As a precautionary measure, access restrictions currently remain in place while validation efforts continue. Once they have confirmed services are stable and secure, the block will be removed and normal access restored.
Thank you for your patience as we work through this for our faculty and students.
Status Update May 7, 2026 at 8:26 p.m.
We understand the impact this disruption is having and want to reassure you that appropriate class extensions will be provided. Once the outage is resolved, you will receive guidance from your faculty on the next steps for wrapping up your courses.
We also wanted to share that you still have the ability to access your digital course materials.
You can access the My Materials LTI externally. You will need to pick Laurel Ridge Community College from the drop down and enter your student email.
From there you should still be able to access Kortext and RedShelf just like you would from Canvas.
Status Update May 7, 2026 at 6:29 p.m.
Canvas is currently down due to an active issue involving Instructure, the company that provides the Canvas learning management system.
This issue is not the result of unauthorized activity within VCCS systems.
Some users may currently see unusual login pages or messages indicating unauthorized or malicious activity when attempting to access Canvas.
Until further notice, students should NOT:
- enter their username or password into Canvas or any Canvas-related login screen
- click links or open files presented through Canvas or related pages
- approve unexpected MFA or authentication prompts related to Canvas access
Please also stay alert for phishing or suspicious emails. Be cautious of messages that:
- come from unfamiliar or strange email addresses
- ask you to click links and log in
- request your username, password, or personal information
- pressure you to act quickly
Virginia’s Community Colleges and Canvas support staff will never ask you for your password by email.
If something feels suspicious, do not click on the link, approve the request, or respond to the message.
VCCS Information Technology Services is actively staying informed with Instructure as they work through the situation and restore services.
Thank you for your caution and patience.
Status Update May 7, 2026 at 4:10 p.m.
Canvas is currently unavailable due to a potential security issue being investigated across the VCCS system. Students should not attempt to access or use Canvas at this time and should not click any suspicious links or popups related to Canvas. Laurel Ridge will provide an update once the issue has been resolved.