Hackerattack mot lärplattform som över 30 svenska universitet och högskolor använder

Universitet och högskolor i Sverige har drabbats i en global hackerattack.

Uppgifter kan ha läckts och under fredagen stängdes lärplattformen Canvas ned helt efter att attackerna intensifierats.

Det är företaget Instructure, som levererar lärplattformen Canvas, som utsatts av en global hackerattack under veckan.

Över 30 universitet och högskolor i Sverige använder Canvas och Luleå tekniska universitet fick information om attacken under måndagen.

Natten mot fredag kom ny information

– Instructure har inte betalat lösensumman som hackergruppen ville ha och då har de fortsatt attacken. Då valde Instructure att stänga ned hela Canvas.

– Vid vissa lärosäten fungerar det och vi hoppas att det ska komma tillbaka till oss också så att vi kan återgå till det normala, säger Jennie Hägg Wilhelmsson.

Det är hackergruppen Shinyhunters som har tagit på sig attacken. De hotar att läcka data om inte en överenskommelse är i hamn innan den 12 maj.

Det är inte bekräftat vilken typ av uppgifter som ska ha läckt ut, men det kan bland annat handla om namn, e-postadresser samt meddelanden.

Microsoft: In May 2020, ShinyHunters also claimed to have stolen over 500 GB of Microsoft source code from the company's private GitHub account. The group published around 1GB of data from the hacked GitHub account to a hacking forum. Some cybersecurity experts doubted the claims until analyzing the code; upon analysis, ShinyHunters' claims were no longer in question. Microsoft told Wired in a statement that they are aware of the breach. Microsoft later secured their GitHub account, which was confirmed by ShinyHunters as they reported being unable to access any repositories.

Google: On June 4, 2025, Google Threat Intelligence Group (GTIG) reported on UNC6040, a cluster of voice phishing campaigns targeting organizations' Salesforce instances. The attackers used modified versions of Data Loader to export Salesforce data and subsequently extort the victims. GTIG attributed the activity to ShinyHunters. According to DataBreaches.net, ShinyHunters have merged with Scattered Spider. On August 5, 2025, Google confirmed that a corporate Salesforce instance of Google's containing contact information and notes for small and medium-sized businesses had been compromised by UNC6040/ShinyHunters activity.

European Commission: In March 2026, ShinyHunters hacked and leaked over 350GB of data from the EU Commission. PII, email communications, sensitive documents, technical data, data belonging to 42 internal clients and at least 29 EU entities, and more were affected according to CERT-EU which also attributed ShinyHunters to the breach and leak.

Rockstar Games: In April 2026, ShinyHunters breached cloud-linked systems of Rockstar Games via a third-party service (Anodot → Snowflake), claiming to have stolen nearly 80 million records. The group issued a ransom deadline of April 14 and, after it expired, leaked portions of the data online, including internal analytics and business metrics (such as GTA Online and Red Dead Online performance data). Rockstar confirmed the breach and stated that only limited, non-material internal data was affected, with no impact on operations, services, or player data.

The 2026 Canvas security incident is an ongoing cybersecurity incident, outage, and data breach affecting Canvas LMS, a learning management system operated by its parent company Instructure. In early May 2026, Instructure disclosed that it was investigating a cybersecurity incident involving certain user data, including names, email addresses, student ID numbers, and messages among users. The company said it had found no evidence that passwords, dates of birth, government identifiers, or financial information were involved.

Despite Instructure's claim that the situation had been resolved, on May 7, Canvas was hacked again; Its login page was replaced with a ransomware message by ShinyHunters (sic), the criminal hacking group which claimed responsibility. ShinyHunters threatened to release Canvas' sensitive data unless its ransom was paid by the end of May 12. As of May 8, however, Instructure itself reported on their status page no incidents whatsoever related to the May 7-8 hack, and claimed that access to their website had been restored to most users.

Canvas har utsatts för dataintrång och personuppgifter har läckts.