USF confirms impact from nationwide cybersecurity incident

The University of South Florida has confirmed that it is among the universities affected by a nationwide cybersecurity incident involving Instructure, the company that operates the Canvas learning management platform used by schools and universities across the country.

In a public statement posted to students, faculty and staff, USF said Instructure notified the university that it had been impacted by the incident, which has disrupted access to Canvas during a critical period near the end of the spring semester.

“The University of South Florida is aware of a nationwide cybersecurity incident involving Instructure, the company that owns Canvas,” the university said in its statement. “Instructure has informed us that USF is one of the universities impacted by the incident.”

Canvas is one of the most widely used online learning management systems in higher education, serving thousands of institutions globally. The platform is used for coursework submissions, grades, messaging, assignments and virtual classroom management.

USF officials said the outage comes at a particularly difficult time for students still completing final exams, makeup testing and coursework submissions.

“Temporarily, Canvas cannot be accessed,” the university stated. “USF understands the inconvenience this causes for our students, faculty and staff, especially at the end of a semester.”

The university added that final grades are not due until 11:59 p.m. Tuesday, May 12, and said administrators are “exploring alternatives for those affected” while updates continue to emerge.

The cyberattack has been linked to the hacker group ShinyHunters, which reportedly claimed responsibility for breaching Instructure systems and stealing data connected to thousands of schools, colleges and universities nationwide.

According to previous reports, the compromised information may include names, email addresses, student identification numbers and private messages exchanged through Canvas. Instructure has stated that passwords, Social Security numbers and financial information were not exposed.

USF emphasized that it is continuing to work directly with Instructure and law enforcement as the investigation unfolds. “Instructure has engaged a third-party forensics firm for an investigation and notified law enforcement authorities,” the statement reads.

University officials are also urging students and employees to remain alert for phishing attempts and suspicious communications that could exploit the breach.

“USF’s priority is the security and privacy of our students, faculty and staff,” the statement continued. “We encourage everyone to remain vigilant against phishing or suspicious communication, and report any unusual activity.”