Canvas Outage Disrupts San Jose State Students

Canvas is the place where a lot of college life actually happens — assignments, grades, lecture slides, quizzes, messages, the whole routine. So when it went dark at San José State on May 7, this was not some minor IT hiccup. It landed right as students were studying for finals and trying to turn work in. The immediate problem was access. The bigger problem was that the outage came in the middle of a real cybersecurity incident affecting Canvas nationwide. (sjsu.edu) ### What broke at San José State? SJSU told students and staff that Canvas was “down and not operational” as of May 7. That meant no normal access to course materials, assignments, or the messages people use to sort out deadline confusion at the end of the semester. And this was not just an SJSU outage — the California State University system said C(sjsu.edu)sjsu.edu) ### Why did Canvas go offline? The short version is that Instructure, the company behind Canvas, was already dealing with a confirmed security incident from late April. Then, on May 7, the situation escalated. A cybercrime group claimed responsibility, and Canvas users around the country started seeing a ransom message on the login page. Instructure(sjsu.edu)e offline for most users while it tried to contain the problem. (status.instructure.com) ### Was this a San José State hack? Not directly. That part matters. SJSU described this as a vendor-level incident involving Instructure, not a campus system getting individually broken into. In other words, the risk came through the software provider that schools rely on, which is why so many colleges got hit at once. That also explains why local campus staff (status.instructure.com)ly flip the system back on themselves. (sjsu.edu) ### What data may have been exposed? The current picture is unsettling but narrower than the worst-case rumors. SJSU said the data may include names, email addresses, student ID numbers, and user messages stored in Canvas. CSU relayed the same basic scope from Instructure. Both also said there was no evidence that passwords, Social Security numbers, (sjsu.edu)ake the breach harmless — message histories and school identifiers are still useful for phishing and impersonation. (sjsu.edu) ### Why are phishing warnings such a big deal? Because this is exactly when fake emails work best. Students are already expecting urgent notes about finals, deadlines, grade changes, and login problems. If someone gets a message that looks like it came from a professor, Canvas admin, or campus help desk, the timing makes it more believable. SJSU is (sjsu.edu)hich is basic advice but also the most practical thing students can do right now. (sjsu.edu) ### Is Canvas back? Mostly, but not cleanly all at once. Instructure’s status page said late on May 7 that Canvas was available for most users, while Canvas Beta and Canvas Test were still in maintenance. That means the platform was coming back online, but schools were still dealing with the aftereffects — missed work, delayed communication, and uncertainty about what data exposure means campus by campus. (status.instructure.com) ### Why does this story matter beyond one outage? Because it shows how concentrated higher education tech has become. One vendor gets hit, and suddenly students across a whole university system — and far beyond California — lose access during the highest-stakes week of the term. The breach itself is serious. But the outage exposed something else too: universitie(status.instructure.com)rectly control. (lts.calstate.edu) ### Bottom line? For San José State students, the immediate story is simple — Canvas failed at the worst possible moment. But the deeper story is about dependence. When a tool like Canvas breaks, coursework, communication, and trust all break with it. (sjsu.edu)