Mashable

The hacking collective ShinyHunters says it disrupted a major education platform not once but twice over the past few weeks. And the data breach could not have come at a worse time for students and teachers. These events unfurled during school finals at many of the affected institutions.

On April 30, Instructure, the edtech company behind Canvas, the popular Learning Management System (LMS) utilized by educational institutions around the world, temporarily went offline. A day later, Instructure confirmed that a "criminal threat actor" was behind a data breach into the company's systems.

According to ShinyHunters, the group stole data from 275 million Canvas users at nearly 9,000 schools worldwide. The affected users include students, teachers, and staff, and while no passwords or other sensitive data were taken, the data stolen was significant. The hackers claimed usernames, email addresses, student IDs, and private messages exchanged on the platform were part of the stolen data. Some of the impacted users are underage students.

Mashable 101 Fan Fave: Vote for your favorite creator today!

Shortly after the hack, Instructure confirmed that it had revoked access from the bad actors, took measures to fix the issues and prevent another breach from occurring, and brought Canvas back online.

However, just one week later, ShinyHunters says it hit Canvas again. This time, the hackers compromised school-specific login pages for the platform and defaced the pages with messages threatening to publicly release the stolen data from the previous breach unless Instructure agreed to "negotiate a settlement."

A monetary demand from ShinyHunters was not surprising. The ransomware group is known for extorting victims following a data breach. A second breach at Instructure, however, was a surprise. Canvas once again went offline, and when it came back, the company had removed the source of the second incident: Free-For-Teacher accounts.

According to a newly updated incident page on Instructure's website, the company says it "identified a vulnerability regarding support tickets in our Free for Teacher environment that was exploited." 

"We temporarily disabled Free for Teacher while we complete a full security review," the company said. "We know that's disruptive, and we didn't make that call lightly. But keeping the entire Canvas platform secure has to come first."

While the second breach did not result in any stolen data, the timing of the security incident could not have been worse for students, as many schools are currently holding finals and other scheduled deadlines for end-of-year coursework.

As PCMag reports, "students and professors struggled to access the online platform used to submit assignments and tests." (Disclosure: PCMag and Mashable are both owned by the same parent company, Ziff Davis.)

According to data provided to Mashable from Alliance Risk Trends, Google searches for "canvas hacked" and "canvas down" spiked roughly 1,000 percent just this past Friday. There was a combined search volume of more than 1 million for searches involving the Canvas security incidents and subsequent downtime.

Some readers reached out to Mashable to share their experience. One parent of a student at Seton Hall University forwarded Mashable an email that the school sent out while Canvas was down.

"We know the timing of this is hard," the school's email to students read. "Finals are underway, coursework is due, and Canvas being offline right now is genuinely disruptive."

Some schools, such as Bayton University in Texas, postponed final exams on Friday specifically due to issues accessing Canvas.

"With Canvas down at the national level, Baylor University will delay final exams tomorrow (Friday, May 8, 2026)," the school said in a statement.

Canvas is now back online. However, ShinyHunters' "settlement" deadline to release the data on May 12 still looms.

Want to learn more about getting the best out of your tech? Sign up for Mashable's Top Stories and Deals newsletters today.

Counterfeit DDR5 RAM is circulating across online storefronts and gray-market retailers, and some fake modules are convincing enough to pass visual inspection — until you cut them open. According to Digital Trends, the chips installed on the fraudulent sticks aren't memory at all, but merely fiberglass boards shaped to resemble legitimate DRAM.

The issue was reported by a Japanese X user who purchased what appeared to be a genuine SK Hynix SO-DIMM laptop module and physically dissected it after becoming suspicious. Inside, they found non-functional fiberglass pieces where the memory chips should have been.

"At first glance, they look like regular memory sticks, but the chips actually installed on them are just bare circuit boards—plastic boards. I removed them and cut them open to check," reads a translation of the X post.

Some of these counterfeits are reportedly being sold openly on auction platforms like Yahoo Japan under listings marked "untested" or "junk," with sellers explicitly refusing returns.

Mashable 101 Fan Fave: Vote for your favorite creator today!

The problem is compounded with desktop DDR5 kits, where large heatspreaders cover the memory chips entirely. Without visible chips to inspect, Digital Trends notes, buyers often have no way to confirm what they've purchased until a system fails to boot or crashes repeatedly.

The conditions for this kind of fraud are straightforward. DDR5 prices have been rising sharply for over a year, driven by AI-related demand that has sparked a global memory crisis. And as memory manufacturers prioritize enterprise and server production over consumer supply, there's no end in sight for shoppers.

Mashable previously reported that Framework, the modular PC maker, raised its DDR5 prices multiple times through late 2025, with a 48GB module jumping from $240 to $620 over the course of months. Samsung warned manufacturing partners of further price hikes to come, with major laptop makers including Lenovo, Dell, and HP warning of price increases.

Euphoria's Cassie Howard (Sydney Sweeney) has worn many hats. Figure skater. OnlyFans model. Kaiju.

The latter hat comes into play in Season 3, episode 5, when Cassie's OnlyFans fame goes to her head in a supersized fantasy sequence. As she watches her OnlyFans notifications pour in, Cassie imagines herself growing into a giantess and stomping through downtown Los Angeles, ready to take Hollywood by storm.

It's a technically impressive sequence that draws inspiration from 1958's Attack of the 50 Foot Woman and the Godzilla franchise. In a behind-the-scenes video released by HBO, the Euphoria team takes viewers through how they brought it all to life by building painstaking miniatures

"It was a lot of fun. It took about a year to build all the miniatures," Euphoria creator Sam Levinson said in the above behind-the-scenes video.

Cassie's dream of Hollywood glory is Euphoria Season 3's first major departure from reality, something which used to be a staple in earlier Euphoria seasons. Think Rue's (Zendaya) views of herself as a private detective, or her relapse at the end of Season 1, which turns into a memorable musical number.

It's a shame, then, that the inventive Cassie-zilla sequence is tied to a hyper-sexualized montage of her OnlyFans work. Euphoria's portrayal of sex work has already earned criticism from sex workers, and it continues to fall into the same trap in episode 5: highlighting fantasies of sex work without actually fleshing out the sex workers themselves. After all, Cassie is little more than a fame-hungry caricature by this point, and as fun as it is to see Euphoria embrace practical monster effects, it's not enough to mask the emptiness and shock value of her narrative.

New episodes of Euphoria Season 3 premiere Sundays at 9 p.m. ET on HBO and HBO Max.