Canvas hack: Ransom demand threatens Nordic universities

A hacking group is targeting Instructure's Canvas, a major educational platform used widely in Nordic universities, with a ransomware demand. The attackers claim to have stolen sensitive data and threaten to leak it unless a payment is made. The incident was first reported on May 7, 2026, and has rapidly gained attention in Sweden, trending with over 1,000 searches. Canvas is a widely used learning management system in Swedish and other Nordic higher education institutions. Many prominent Nordic universities, including Uppsala University, Lund University, and the University of Helsinki, rely on Canvas for course management. This widespread use raises serious concerns about potential data breaches involving student records, academic materials, and other confidential information. The "pay or leak" threat from hackers directly impacts students and faculty, making it a critical cybersecurity story in the region. There is currently no official confirmation from Instructure regarding the hack or the ransom demand. Students and faculty across the region are facing the direct consequences of this threat, as their personal data and academic work may be at risk. The incident remains under investigation by university administrators and cybersecurity officials. The growing number of searches in Sweden indicates a high level of public and academic concern. The lack of official statements from the company leaves many questions unanswered about the scope and validity of the data theft. The situation highlights the vulnerability of digital education tools in the Nordic region.