A widespread cyberattack targeting the learning platform Canvas is disrupting thousands of schools across the country, including in Colorado. It’s hitting students at one of the worst possible times: finals week.

Cybercriminal group ShinyHunters claimed credit for the attack, breaching systems tied to Instructure, the company that runs Canvas. Canvas is used by 41% of higher education institutions across the country to deliver courses. Millions of K-12 students rely on the platform as well.

In Colorado, more than 20 schools, including Colorado School of Mines, Metropolitan State University of Denver, the University of Denver, the University of Colorado Boulder, Colorado State University, and the University of Northern Colorado, have been affected by the cybersecurity attack.

The group is attempting to extort the company, threatening to release massive amounts of student data if demands are not met.

For students like Flannery Headley, a political science major at MSU Denver, the disruption is more than an inconvenience — it’s a major source of stress.

“The moment I tried to click on something, it gave me this maintenance down page,” she said. “I started Googling things, and I saw this whole thing about the hack.”

Headley says she was working on assignments when Canvas suddenly stopped functioning.

MSU sent out guidance telling students not to log into Canvas and to wait for updates from professors.

Like many students, Headley is now left in limbo, unsure how finals will be submitted or graded.

“This final I’ve spent the last week working on might not matter,” she said. “At least one of my grades is hinging on another final, whether I’m going to pass or fail.”

The attackers claim to have stolen large amounts of data, including names, student ID numbers, email addresses, and academic records.

Experts say the real risk may not just be disruption, but what happens next.

“The worst they could do is release it,” said MSU Denver computer science professor Steve Beaty. “There’s been minor leaks and breaches and these sorts of things from time to time, but nothing on the scale of this.”

Beatty says the group claims to have terabytes of student data, which could include personally identifiable information protected under federal privacy laws. If released, that information could be used for scams, identity theft, or further cyberattacks.

Canvas is a cloud-based system used by thousands of institutions, meaning a single attack can have massive ripple effects.

“They took the entire Canvas infrastructure down,” Beatty said. “That affects about 9,000 schools, tens of thousands of people in Colorado alone.”

Right now, schools are scrambling to find workarounds, from email submissions to alternative testing methods.

There is no current timeline for resolution. The hacker group has set a May 12 deadline for the company to respond before potentially releasing the data.

Until then, students like Headley are left waiting, hoping their work doesn’t disappear.

“I’m going to keep working on my finals,” she said, “but I’m not sure what that’s going to look like.”

BOULDER, Colo. — A man was sentenced to life in prison without the possibility of parole after pleading guilty Thursday to killing one person and injuring a dozen others in a 2025 firebombing attack on a demonstration in Boulder, Colorado, in support of Israeli hostages in Gaza.

Subscribe to read this story ad-free

Get unlimited access to ad-free articles and exclusive content.

Advertisement

Mohamed Sabry Soliman looked down at a desk throughout the sentencing. He has meanwhile pleaded not guilty to federal hate crime charges for the attack last June. Prosecutors are weighing whether to seek the death penalty in the federal case, according to his attorneys.

Authorities say Soliman threw two Molotov cocktails at demonstrators at a pedestrian mall in downtown Boulder, a city of 100,000 people northwest of Denver that’s home to the University of Colorado.

Karen Diamond, 82, was injured in the attack and later died. A dozen others were also injured.

Soliman is an Egyptian national who federal authorities say was living in the U.S. illegally. Investigators allege he planned the attack for a year and was driven by a desire “to kill all Zionist people.”

Speaking to the court through an interpreter for nearly a half hour, Soliman offered apologies to the victims and condolences for Diamond’s death. “There are no words that can express my sadness for her passing,” Soliman said.

He said he wasn’t asking for leniency at sentencing for his convictions in state court and wants prosecutors pressing federal hate crime charges against him to seek the death penalty.

“If I went back, I would not have done this as this is not according to the teaching of Islam,” Soliman said. “What I did came out of myself and only myself.”

District Attorney Michael Dougherty said Soliman’s guilty pleas don’t show an acceptance of responsibility but rather “a surrender to the strength of the evidence” against him. Despite Soliman’s claims he doesn’t hate people who practice the Jewish faith, Judge Nancy Salomone concluded Soliman targeted the victims because they were Jewish. “You chose a time and a place and a set of circumstances and weapons that were designed to inflict the most pain that you could,” the judge said.

In a statement read earlier in court by a prosecutor, Diamond’s sons asked that Soliman not be allowed to see his family again “since he is responsible for our mother never seeing her family again.”

Andrew and Ethan Diamond said their mother suffered “indescribable pain” for over three weeks before her death. “In those weeks, we learned the full meaning of the expressions ‘living hell’ and ‘fate worse than death,’” Diamond’s sons said in the statement.

Soliman’s federal attorneys have said in court filings the attack “was profoundly inconsistent” with Soliman’s prior conduct and “came as a total shock to his family.”

At the time of the attack, Soliman had been living with his family in a two-bedroom apartment in Colorado Springs — about 97 miles away. He had moved to the U.S. from Kuwait in 2022 with his wife and their five children and worked in a series of low-paying jobs.

The couple divorced in April.

Investigators allege Soliman told them he intended to kill the roughly 20 participants at the weekly demonstration at Boulder’s Pearl Street pedestrian mall. He threw two of more than two dozen Molotov cocktails he had with him while yelling, “Free Palestine!”

Police said he told them he got scared because he had never hurt anyone before.

Federal prosecutors allege the victims were targeted because of their perceived or actual connection to Israel. Soliman’s federal defense lawyers argue he should not have been charged with hate crimes because he was motivated by opposition to Zionism, the political movement to establish and sustain a Jewish state in Israel.

An attack motivated by someone’s political views is not considered a hate crime under federal law.

State prosecutors have identified 29 victims in the attack. Thirteen were physically injured. The others were nearby and considered victims because they could have been hurt. A dog was also injured in the attack, and Soliman was charged with animal cruelty.

Soliman’s wife, Hayam El Gamal, and their children spent 10 months in immigration detention until a federal judge in Texas ordered their release in April.

An immigration appeals court had dismissed their case to stay in the U.S. and issued a deportation order. But U.S. District Judge Fred Biery in San Antonio allowed their release on the condition that El Gamal and her oldest child, who is 18, wear electronic monitoring.

Soliman’s attorneys seek to block the family’s deportation until a judge determines they won’t need to be present for court proceedings in his federal case.

Toss out Wednesday night’s results. Michael Lorenzen believes he can pitch at Coors Field. His manager thinks so too.

The box score said otherwise: Over five innings, the Mets had 11 hits off the Rockies’ right-hander, leading to seven runs as the Mets cruised to a 10-5 win.

The announced crowd at Coors was 11,155 on a night when the temperature at first pitch was 41 degrees. That is the lowest home crowd in Rockies history. However, the Rockies said that many fans exchanged their tickets for another game after this week’s snow, postponed games, and the fact that Wednesday’s game was pushed back from a 6:40 p.m. start to a 7:20 p.m. start.

The fans who stayed away were probably glad they did, because the Rockies suffered their sixth consecutive loss, and their sweep of the Mets at Citi Field on April 24-26 seems long ago and far away.

Manager Warren Schaeffer saw a mixed bag from Lorenzen.

“That’s a lot of hits, 11, and he had three walks in there that hurt,” Schaeffer said. “Good pitch mix, but they were on him. When he threw it over the plate, they put the ball in play — whether hard sometimes or not. They made it work, so hats off to them.”

Lorenzen’s night began ominously when Juan Soto hit Lorenzen’s third pitch of the game 435 feet and into the left-centerfield seats. It was the first leadoff home run of Soto’s career.

Lorenzen said he “wasn’t making excuses,” but said he did feel like he threw decent pitches, save for a leadoff homer by Soto and a triple by MJ Melendez two batters later.

“I wouldn’t say they were on me, there was a lot of, like, 77 mph hits,” said Lorenzen, who is 2-4 with a 6.92 ERA after eight starts (nine appearances). “There was one Coors-style double in there. There were a lot of bloops that were hit over second base on changeups and sinkers.”

The right-hander, whom the Rockies signed to a one-year, $8 million contract, with a team option worth $9 million next season, owns a 9.64 ERA after four starts at Coors this season.

But Schaeffer put his full faith and trust in Lorenzen, Coors or no Coors.

“I see too small of a sample size to make a thing (out of) that one,” Schaeffer said. “The first game that he pitched against Philadelphia (nine runs on 12 hits over three innings) was a throw-away game. Michael will be fine. He wanted to come here, to pitch here specifically. He’ll figure it out.”

Lorenzen said it’s “just been kind of frustrating” for him this season.