The University of Oxford restored access to its Canvas learning platform on 11 May 2026, ending a three-day suspension implemented as a precautionary measure after the university was notified of two separate security incidents affecting Canvas.
The University of Oxford took the platform offline on 8 May after learning that an unauthorised party had accessed user information. The university notified the Information Commissioner’s Office on 7 May, one day after becoming aware of the breach, to ensure it met all data protection requirements.
According to the university, the information accessed by hackers included usernames, email addresses, messages shared on the platform, course names, and enrolment details. The institution confirmed there is no evidence that sensitive information, such as passwords, financial details, exam results, or academic records, was compromised.
The breach originated through a security vulnerability in the Free-for-Teacher accounts managed by Instructure, the company that provides the Canvas software. This global incident is now considered the largest educational security breach on record, affecting approximately 275 million users across 8,809 educational institutions in at least 50 countries.
To secure confirmation that the stolen data would be destroyed, Instructure paid a ransom to the hacking group known as ShinyHunters on 11 May. The University of Oxford subsequently restored access to the learning system at approximately 12 noon on that same day after receiving further security assurances from the service provider. Students and staff have been advised to remain alert for potential phishing attempts following the incident.
About this article: This story was put together with the help of AI tools and checked by a real person on our team. We're a small crew trying to cover as much of the UK as we can on a limited budget. We're getting better every day - but we're not perfect yet. If something looks off, let us know. You're part of the process.
