Canvas Cyberattack: What College Students Should Do Now

During finals season, Canvas experienced a cybersecurity incident and outage that affected schools using the platform. Reports from the Associated Press/PBS noted that Canvas was unavailable for many users and that some colleges had to adjust finals, assignments, or course access while technology teams reviewed the situation.

For students, the biggest takeaway is simple: even if your school says Canvas is back online, treat unexpected messages, links, and login prompts with extra caution for the next few weeks.

What happened?

Canvas is run by Instructure and is used by colleges to manage course content, grades, assignments, lecture materials, messages, and other class tools. In early May 2026, schools reported a nationwide Canvas security incident and global outage. Rutgers, for example, temporarily suspended or limited Canvas access while its technology office evaluated the safety and stability of the system.

Public reporting also said a hacking group claimed responsibility for the incident. Students should avoid guessing about exactly what data may have been involved unless their own university sends an official notice. Your school’s IT office is the best source for campus-specific details.

What students should do now

• Use your school’s official Canvas link. Do not log in from random emails, texts, DMs, or search ads.
• Be suspicious of “urgent” Canvas messages. Scammers may pretend to be Canvas, your professor, financial aid, housing, or campus IT.
• Do not share your password or verification codes. Real IT teams should not ask for your password by email or text.
• Turn on multi-factor authentication if your school offers it.
• Change your password if your school recommends it, if you reused that password elsewhere, or if anything looks strange on your account.
• Download important course materials when systems are available, especially before finals or major deadlines.
• Screenshot assignment instructions and due dates if your class is relying heavily on online tools.

Watch for phishing after the outage

Cyber incidents often lead to follow-up scams. A fake message might say your Canvas account is locked, your final grade is missing, your tuition payment failed, or your housing application needs verification. The goal is usually to get you to click a link and enter your school login.

Before clicking, pause and ask:

• Does the sender’s email address exactly match my school?
• Does the link go to my official university domain?
• Is the message pressuring me to act immediately?
• Can I reach the same page by going directly through my school portal?

If something feels off, do not click. Go directly to your university website or contact your campus help desk.

What if Canvas goes down again?

Finals week is stressful enough without losing access to class materials. Keep a small backup plan:

• Save syllabi, rubrics, and major assignment instructions as PDFs.
• Keep professor emails and office-hour details somewhere outside Canvas.
• Use your school email for official updates.
• If a deadline is affected, email your professor early and clearly.

Bottom line

The Canvas incident is a reminder that college life runs on digital systems now — classes, housing, payments, advising, and student services all depend on logins. Protecting your school account protects more than your grades.

When in doubt, go directly to your school’s official website, check your campus IT alerts, and avoid links from unexpected messages.

Sources: Associated Press/PBS NewsHour reporting on the Canvas outage and Rutgers Office of Information Technology updates about the nationwide Canvas security incident.