SAN ANTONIO — The Canvas educational platform was taken offline on Thursday after unauthorized access by a hacking group identified as ShinyHunters, and service has since been restored, parent company Instructure said. The disruption affected more than 8,000 schools and colleges in the United States, including Harvard University and the University of Michigan, where systems were unavailable during finals week.

Canvas sites first reported technical problems on Thursday morning. Administrators detected the unauthorized activity, revoked the intruder's access, and restored full service. Approximately 9,000 schools worldwide use Canvas, a cloud platform students use to complete assignments, receive grades, and access class materials.

Instructure contacted the FBI, the U.S. Cybersecurity and Infrastructure Security Agency, and international cybersecurity groups about the breach. The company is investigating the incident and has created a website to provide updates. "Canvas is fully back online and available for use," Instructure said.

"As we respond to this incident, we're focused on three things: completing a rigorous investigation, communicating verified information to impacted customers, and continuing to strengthen the safeguards that protect customer and student data. Trust is earned through actions and we're committed to earning yours," Instructure said.

The same hacking group breached Canvas's cybersecurity on April 29, and Instructure warned affected schools the following Tuesday. Data taken in the April 29 breach included email addresses, student ID numbers, and messages among Canvas users. Many schools reported that no personal information was compromised. The group posted online that it had accessed billions of private messages.

Instructure received a ransom note from ShinyHunters claiming to have data from schools and threatening to leak it unless a settlement was paid by May 12. A ransom message posted to a dark web leak site advised affected schools to consult a cyber advisory firm and contact the hackers privately by the following Tuesday to prevent data release.

Free-For-Teacher, a program allowing educators to sample Canvas at no cost, was the entry point for hackers in both the April and May breaches. About 76,000 teachers have used the service since its launch in 2022. Instructure will temporarily shut down Free-For-Teacher accounts following the attack.

In San Antonio, Austin Independent School District cut off access to Canvas/BLEND from its portal and direct URL on Thursday. District officials said they did not believe other systems were impacted and advised parents and students not to access Canvas outside the portal until confirmation that it was safe. The district is conducting its own security checks, with plans to finish by the end of Friday and restore access for students and staff on Monday.