New York City universities and K-12 schools were among the thousands of educational programs caught in the crosshairs of what’s being called the “biggest student data privacy disaster in history,” school officials confirmed Friday.
Canvas, a popular education platform used for course materials and communications, was down for several hours Thursday after a cyberattack as many college students were preparing for final exams.
Hackers calling themselves “ShinyHunters” claimed responsibility for the security breach, which they said affected 9,000 schools and allowed access to billions of private messages and other records. The group has been connected to other cyberattacks, including a 2024 breach of Ticketmaster.
Student and teacher access to Canvas, a product from the education technology company Instructure, was largely restored by Friday.
New York City Schools Chancellor Kamar Samuels released a statement Friday about two recent “data privacy issues,” one of which involved Canvas. The Canvas incident impacted seven public schools.
“New York City Public Schools places a premium on the protection of student data and use of technology, and devotes significant resources to doing so,” Samuels said.
“In line with that, we act quickly and urgently when we learn of a potential breach. In such cases, we work around the clock with any vendor that may be involved, as well as all appropriate law enforcement agencies and NYC Cyber Command to drive towards resolution and safeguards as soon as feasible.”
Barry Williams / New York Daily News
Schools Chancellor Kamar Samuels is pictured on March 5, 2026. (Barry Williams / New York Daily News)
The chancellor added that officials were investigating and would share more information when available. A spokeswoman for the public schools did not immediately identify the seven schools.
The outage also hit Columbia University during “reading week,” between the end of classes and the start of final exams. Columbia’s Mailman School of Public Health postponed all exams and assignments due Friday, school officials said on X. The platform is also used by the Columbia-affiliated Barnard College, according to the student newspaper.
“Individual schools and instructors will communicate directly with students regarding any residual impacts to final exams or assignment deadlines,” Columbia Provost Angela Olinto and two university officials wrote to students and faculty on Friday.
A New York University spokesman said the school does not use Canvas, but instead works with a different vendor, Brightspace, that provides the same services. CUNY also does not use Canvas, a spokesman said.
Brian Watkins, a spokesman for Instructure, issued a statement Friday, saying, “Yesterday, Instructure discovered the unauthorized actor involved in our ongoing security incident made changes to the pages that appeared when some students and teachers were logged in. Out of an abundance of caution, we immediately took Canvas offline to contain access and further investigate.”
Watkins said Instructure confirmed the hacker exploited an issue related to free teacher accounts, which have been shut down for now.
“This gives us the confidence to restore access to Canvas, which is now fully back online and available for use. We regret the inconvenience and concern this may have caused.”
The second data privacy incident in New York City’s public schools, referenced in the chancellor’s Friday statement, did not involve Canvas.
On the Graphic Campus in the Hell’s Kitchen neighborhood of Manhattan, school administrators detected that malware that can record keystrokes was installed in the computer lab, families were told.
Technology staff have removed the malware from the computers and are working with the NYPD to investigate. School officials told all students and staff to reset their passwords for any accounts they logged into in the computer lab over the last year.
News of the incident followed a Monday audit by State Comptroller Tom DiNapoli that found glaring omissions in the city’s student data privacy policies.
With Daily News Wire Services