Confirmed wording is transcribed character-for-character from a primary source. Use Verify this quote under each message to open that source in a new tab and compare the text yourself.
INITIAL ALERTEmail
Verified verbatim·1625 chars
Dear Faculty, Staff, and Students,
Due to the global cyberattack that has taken Canvas offline at universities across the country, all final exams and assignments, including papers, projects, etc., scheduled for Friday, Saturday, or Sunday are postponed. For the sake of consistency and clarity, the university is extending this policy to all classes, including those that don’t currently utilize Canvas.
Some Canvas users viewed a message as part of the cybersecurity incident that contained malicious website links and other contact points. It is important to not click or visit these links as they can also be sources of malware or potential compromise.
University leaders will consult with the Deans and the Senate Executive Committee regarding next steps and will communicate to the campus community before noon on Sunday, May 10, with more details regarding Canvas, assignments, and final exams currently scheduled for next week.
As more information becomes available, updates will be posted on the University Statements webpage and the 2026 Canvas Incident page. Instructure, the parent company of Canvas, is still investigating and has not shared specific information with us regarding Illinois data included in the breach.
Illinois is one of thousands of universities currently experiencing the same issue. Technology and academic leaders are communicating with our peer institutions as we explore options for next steps. I understand this situation adds new stress and uncertainty to the end of the academic year, and I thank you for your patience as we work through this disruption.
Sincerely,
John Coleman
Provost
Recovered verbatim from the official UIUC Massmail archive page linked from stratcom.illinois.edu university statements
UPDATEEmail+1d
Verified verbatim·3026 chars
Dear Students, Faculty, and Staff,
Earlier this evening, after more than 24 hours of working around the clock, the team at Technology Services received some good news: they were able to restore a connection to Canvas to begin investigating whether the service can appropriately be restored for students, faculty, and staff to use. It will take until midday tomorrow to confirm that continued use does not present undue risk to our university community and their data.
Over the past day, we have listened to concerns expressed by students and instructors. We recognize that the unavailability of our learning management system continues to create uncertainty during an already stressful time of the year. At the same time, we remain committed to prioritizing the security of the members of our university community and their data.
Based on the information currently available to us, we envision two possible scenarios for how the weekend and the rest of finals week will proceed. We do not wish to introduce additional uncertainty but we do want to give students and instructors the greatest possible advance notice that we can. We plan to communicate tomorrow afternoon when we know which path we will take.
If Canvas is restored for use on Saturday.
If it is determined appropriate to restore for use for faculty, students, and staff, our team will reconnect Canvas at Illinois and notify users it is back online. If Canvas is back online by 4 p.m. tomorrow, all exams originally scheduled for Friday, May 8, will take place on Sunday, May 10. All exam times and locations will remain unchanged from their originally scheduled time on Friday, with only the date shifting to Sunday. Students who cannot take exams on Sunday will be offered alternatives as determined by their department and instructor. Instructors who cannot facilitate exams on Sunday will be offered options by their department.
Similarly, course instructors will be able to assign a new due date for any final assignments, projects, or other final evaluations that were originally due on Friday or Saturday. Instructors have discretion to assign new due dates as they deem appropriate and may communicate directly with students about their expectations.
If Canvas cannot be safely restored for use.
If it is determined that Canvas cannot be turned back on safely, we will communicate with deans, department heads, and instructors regarding alternate ways to end the semester, taking into consideration travel arrangements, housing, graduation, and human resources. We will share more information before noon on Sunday, May 10, as previously communicated in my message to you on Thursday, May 7.
We have published FAQs and updates based on the information we have available to us. I strongly urge you to explore those as they address the most common questions we have received.
Thank you for your resilience and adaptability during a difficult situation for everyone. Thank you also for your continued support of each other.
Sincerely,
John Coleman Provost
Recovered verbatim from the official UIUC Massmail archive page linked from stratcom.illinois.edu university statements
UPDATEEmail+1d
Verified verbatim·3293 chars
Dear Faculty, Staff, and Students,
Canvas at Illinois is now online and available to our university community. Technology Services has performed integrity and assurance testing to the extent possible.
As previewed in yesterday’s message, all exams originally scheduled for Friday, May 8, will take place on Sunday, May 10. All exam times and locations will remain unchanged from their originally scheduled time on Friday, with only the date shifting to Sunday. Any students who were scheduled to complete one or more final exam on Friday will receive confirmation of the new Sunday exam time(s) in a forthcoming email from the Office of the Registrar. The Computer-Based Testing Facility has added time slots for this week to accommodate canceled exams, and you can make new reservations now.
Similarly, course instructors will be able to assign a new due date for any final assignments, projects, or other final evaluations that were originally due on Friday or Saturday. Any final exams or projects originally planned for Monday through Friday will remain as scheduled, unless otherwise noted by your instructor.
As always, instructors continue to have the discretion to make changes they deem appropriate to meet course objectives. Deans have asked all instructors to be mindful of the needs of students with an approved accommodation through DRES.
Students should look for communication and guidance coming from their instructors. Students who cannot take exams on Sunday will be offered alternatives as determined by their department and instructor. Instructors who cannot facilitate exams on Sunday will be offered options by their department.
As you start to use the Canvas platform again:
Please be aware of increased risk associated with phishing and social engineering. Never share your personal or account information. Remain vigilant and exercise caution when clicking links or opening/downloading attachments via email.
The Canvas application may be slower than normal. Integrations and applications that interact with Canvas may not function initially. Technology Services staff will continue to work to enable them.
Campus support desks will experience higher volume over the next few days, and response times may be delayed.
For additional technical information, visit the Canvas Incident page at go.illinois.edu/2026-Canvas-Incident. There are also additional FAQs on the University Statements webpage.
We all understand this solution is not ideal. Some students, faculty, and staff have religious observances on Sunday. And Sunday, May 10, is Mother’s Day. However, this course of action has emerged as the best option among a list of potential solutions, each of which had complications and downsides. We’ve heard significant concerns from our students about extending finals past Thursday of this coming week. Many students have travel plans, are starting jobs or internships, or have other obligations. Extending exams beyond finals week would introduce additional issues including housing and the conclusion of some instructor contracts on May 16. Holding exams on Sunday keeps the schedule as close as possible to the original timeline.
Thank you again for your understanding during this difficult situation for our university community.
Sincerely, John Coleman Provost
Recovered verbatim from the official UIUC Massmail archive page linked from stratcom.illinois.edu university statements
Message elements
How the first alert is built
To check this alert, Claude (an AI) read it in full 25 separate times, independently. Each read decided whether the message answers each of the six questions and gave a short reason. A final reviewer then weighed all 25 and wrote the plain-English verdict you see when you open a row. The score (for example 22/25) is how many reads agreed; the 25 individual reads are tucked underneath if you want to check them.
Dear Faculty, Staff, and Students,
Due to the global cyberattack that has taken Canvas offline at universities across the country, all final exams and assignments, including papers, projects, etc., scheduled for Friday, Saturday, or Sunday are postponed. For the sake of consistency and clarity, the university is extending this policy to all classes, including those that don’t currently utilize Canvas.
Some Canvas users viewed a message as part of the cybersecurity incident that contained malicious website links and other contact points. It is important to not click or visit these links as they can also be sources of malware or potential compromise.
University leaders will consult with the Deans and the Senate Executive Committee regarding next steps and will communicate to the campus community before noon on Sunday, May 10, with more details regarding Canvas, assignments, and final exams currently scheduled for next week.
As more information becomes available, updates will be posted on the University Statements webpage and the 2026 Canvas Incident page. Instructure, the parent company of Canvas, is still investigating and has not shared specific information with us regarding Illinois data included in the breach.
Illinois is one of thousands of universities currently experiencing the same issue. Technology and academic leaders are communicating with our peer institutions as we explore options for next steps. I understand this situation adds new stress and uncertainty to the end of the academic year, and I thank you for your patience as we work through this disruption.
Sincerely,
John Coleman
Provost
Sourcepresent25/25
Final assessment
Unanimous: signed by 'John Coleman, Provost' on behalf of the university, with university leadership also referenced.
Who is sending the alert and who is responding. People act faster on a message from a clearly identifiable, credible sender, such as a named department, the police, or a branded alert system, than on an anonymous notice. A branded signature counts.
See all 25 individual reads
present: Signed by Provost John Coleman referencing university leaders.
present: Signed by "John Coleman, Provost" on behalf of the University of Illinois.
present: Signed by 'Provost' John Coleman, referencing 'the university'.
present: Signed by Provost John Coleman (University of Illinois).
present: Signed by 'John Coleman, Provost'.
present: Signed by Provost John Coleman.
present: Signed by University Provost John Coleman.
present: Signed by 'John Coleman, Provost' and refers to 'the university'.
present: Signed by Provost John Coleman, "the university" and "University leaders" referenced.
present: Signed by Provost John Coleman, referencing 'Illinois' as the institution.
present: Signed by Provost John Coleman, references the University.
present: Signed by Provost John Coleman, referencing university leadership.
present: Signed by John Coleman, Provost.
present: Signed "John Coleman, Provost" and "the university".
present: Signed by 'John Coleman, Provost'.
present: Signed 'John Coleman, Provost' of Illinois
present: Signed 'John Coleman, Provost' at the University of Illinois.
present: Signed by 'John Coleman, Provost'.
present: Signed by 'John Coleman, Provost', the university.
present: Signed by Provost John Coleman, university leadership.
present: Signed by 'John Coleman, Provost'.
present: Signed 'John Coleman, Provost'.
present: Signed by Provost John Coleman referencing 'the university'.
present: Signed by John Coleman, Provost.
present: Signed by the "Provost", university leadership.
Hazardpresent25/25
Final assessment
Unanimous: names the 'global cyberattack that has taken Canvas offline' and warns of 'malicious website links'.
What the threat actually is. A complete warning names the specific danger, such as a shooter, a fire, a tornado, or a gas leak, rather than a vague emergency, because people decide what to do based on what they are facing.
See all 25 individual reads
present: Names 'global cyberattack that has taken Canvas offline' and 'malicious website links'.
present: Names the hazard as "the global cyberattack that has taken Canvas offline".
present: Names 'global cyberattack that has taken Canvas offline' specifically.
present: Names 'global cyberattack that has taken Canvas offline'.
present: Describes 'global cyberattack that has taken Canvas offline'.
present: Global cyberattack affecting Canvas named.
present: Names 'the global cyberattack' as the threat.
present: States 'global cyberattack that has taken Canvas offline'.
present: "global cyberattack that has taken Canvas offline" and "malicious website links" named.
present: Cites 'the global cyberattack that has taken Canvas offline'.
present: Names "global cyberattack that has taken Canvas offline" and "malicious website links".
present: Global cyberattack that took Canvas offline described.
present: States a global cyberattack that has taken Canvas offline, malicious website links.
present: "global cyberattack that has taken Canvas offline" named.
present: 'the global cyberattack that has taken Canvas offline'.
present: 'global cyberattack that has taken Canvas offline'
present: Names 'global cyberattack that has taken Canvas offline'.
present: References 'global cyberattack that has taken Canvas offline' and 'malicious website links'.
present: States 'global cyberattack that has taken Canvas offline'.
present: Names 'global cyberattack' and 'malicious website links... malware'.
present: 'global cyberattack that has taken Canvas offline'.
present: Describes 'global cyberattack that has taken Canvas offline'.
present: Global cyberattack that took Canvas offline.
present: Describes "global cyberattack" and "malicious website links".
Locationabsent0/25
Final assessment
Unanimous: no physical campus location applies; this is a systemwide online/IT incident affecting universities nationally.
Where the threat is. Saying whether danger is in a specific building, a part of campus, or area-wide lets people judge their own proximity and choose a safe direction. Without a where, a warning is hard to act on precisely.
See all 25 individual reads
absent: No physical location, affects online systems broadly.
absent: No specific physical location is given, the incident is described as system-wide.
absent: No physical location, applies to online systems broadly.
absent: No physical campus location; hazard is a systemwide IT issue.
absent: No physical location, only a systems/campus-wide scope.
absent: No physical location, only "universities across the country".
absent: No physical location given, threat is described as affecting universities nationally.
absent: No physical location given, applies to online systems broadly.
absent: No physical location, this is a systemwide/online issue.
absent: No physical location is relevant or named; this is a systemwide IT issue.
absent: No physical location; only describes an online systems issue.
absent: No specific physical location, applies to online systems broadly.
absent: No specific campus location, refers to universities across the country generally.
absent: No specific location, applies to entire university/online systems.
absent: No physical location, describes an online system issue.
absent: No physical campus location, describes a system outage
absent: No physical campus location, only references to Canvas/systems.
absent: No physical location, it's a systemwide cyber issue.
absent: No physical location; the incident is a system-wide digital issue.
absent: No physical location, describes online system impact.
absent: No physical location, only university-wide systems affected.
absent: No physical location, applies to online systems/university generally.
absent: No physical location, this is a systems-wide notice.
absent: No specific campus location, refers broadly to the university.
absent: No specific location; describes universities nationally.
Guidancepresent25/25
Final assessment
Unanimous: instructs recipients 'not to click or visit these links'.
The protective action to take. A clear, specific instruction, such as shelter in place, evacuate, avoid the area, or run-hide-fight, drives faster and more correct protective behavior than describing the threat alone.
See all 25 individual reads
present: Instructs 'not to click or visit these links'.
present: Instructs "It is important to not click or visit these links".
present: Instructs 'not to click or visit these links' from the malicious message.
present: Instructs 'do not click or visit these links' and postpones exams.
present: Instructs 'not to click or visit these links'.
present: Instructs not to click malicious links; exams postponed.
present: Instructs 'not to click or visit these links'.
present: Instructs 'not to click or visit these links' and postpones exams.
present: "It is important to not click or visit these links".
present: Instructs 'It is important to not click or visit these links'.
present: Instructs "not to click or visit these links".
present: Instructs not to click or visit malicious links.
present: Instructs not to click or visit suspicious links.
present: "It is important to not click or visit these links".
present: 'It is important to not click or visit these links'.
present: 'It is important to not click or visit these links'
present: Instructs 'not to click or visit these links'.
present: Instructs 'not click or visit these links'.
present: Instructs 'It is important to not click or visit these links'.
present: Instructs 'not to click or visit these links'.
present: Instructs 'It is important to not click or visit these links'.
present: 'do not click or visit these links'.
present: Instructs 'not to click or visit these links'.
present: Instructs not to click or visit malicious links.
present: Instructs "not to click or visit these links".
Timepresent25/25
Final assessment
Unanimous: gives specific deadlines, including exams postponed for 'Friday, Saturday, or Sunday' and an update promised 'before noon on Sunday, May 10'.
When the message applies. A timestamp, the word now or immediately, or a phrase like until further notice tells the reader whether the danger is current and how quickly to act.
See all 25 individual reads
present: Specifies 'before noon on Sunday, May 10'.
present: States communication will come "before noon on Sunday, May 10".
present: States postponements for 'Friday, Saturday, or Sunday' and update 'before noon on Sunday, May 10'.
present: Gives 'Friday, Saturday, or Sunday' and 'before noon on Sunday, May 10'.
present: Gives 'before noon on Sunday, May 10'.
present: "before noon on Sunday, May 10" specified.
present: References deadlines like 'before noon on Sunday, May 10'.
present: States 'before noon on Sunday, May 10'.
present: "before noon on Sunday, May 10".
present: References 'Friday, Saturday, or Sunday' and 'before noon on Sunday, May 10'.
present: States postponements "scheduled for Friday, Saturday, or Sunday" and update "before noon on Sunday, May 10".
present: Before noon on Sunday, May 10, and final exams Friday/Saturday/Sunday.
present: Gives before noon on Sunday, May 10.
present: "before noon on Sunday, May 10".
present: 'before noon on Sunday, May 10'.
present: 'before noon on Sunday, May 10'
present: States 'before noon on Sunday, May 10'.
present: Gives 'before noon on Sunday, May 10'.
present: Gives 'before noon on Sunday, May 10'.
present: 'before noon on Sunday, May 10' given.
present: States 'before noon on Sunday, May 10'.
present: 'before noon on Sunday, May 10'.
present: States 'before noon on Sunday, May 10'.
present: Friday, Saturday, or Sunday; before noon on Sunday, May 10.
present: References "before noon on Sunday, May 10".
Impactpresent24/25
Final assessment
Strong majority found impact in the warning that malicious links 'can also be sources of malware or potential compromise'; one read discounted it as lacking physical-harm language, but the stated compromise risk is a consequence.
What the hazard could do to the people in its path. Beyond naming the threat, a complete warning conveys its potential consequences or severity, such as that a tornado can level buildings or that a leak could be explosive, so recipients grasp how much danger they are in. Research on warning message content finds that a concrete impact statement helps people personalize their risk and act sooner.
See all 25 individual reads
present: Warns links 'can also be sources of malware or potential compromise'.
present: Warns the links "can also be sources of malware or potential compromise".
present: Warns links 'can also be sources of malware or potential compromise'.
absent: No stated physical harm, only academic disruption and malware risk noted generally.
present: Warns links 'can also be sources of malware or potential compromise'.
present: Warns links "can also be sources of malware or potential compromise".
present: Warns links 'can also be sources of malware or potential compromise'.
present: Warns malicious links 'can also be sources of malware or potential compromise'.
present: Links "can also be sources of malware or potential compromise" conveys potential harm.
present: Warns the links 'can also be sources of malware or potential compromise'.
present: Warns links "can also be sources of malware or potential compromise".
present: Malicious links can be sources of malware or potential compromise.
present: States links can be sources of malware or potential compromise.
present: Warns links "can also be sources of malware or potential compromise".
present: 'can also be sources of malware or potential compromise'.
present: 'links...can also be sources of malware or potential compromise'
present: Warns links 'can also be sources of malware or potential compromise'.
present: Notes links 'can also be sources of malware or potential compromise'.
present: Warns links 'can also be sources of malware or potential compromise'.
present: Notes links 'can also be sources of malware or potential compromise'.
present: Warns links 'can also be sources of malware or potential compromise'.
present: 'sources of malware or potential compromise'.
present: Warns links 'can also be sources of malware or potential compromise'.
present: Warns links can be sources of malware or potential compromise.
present: Warns links "can also be sources of malware or potential compromise".
Systematic AI judgments with visible reasoning, not human-validated codings.
The University of Illinois Urbana-Champaign is the flagship R1 public research university of the University of Illinois system, enrolling about 56,600 students. On Thursday evening, May 7, 2026, the Canvas learning-management platform was struck by a ShinyHunters cyberattack that replaced its login page with a ransomware message and threatened to leak student data unless paid by May 12. With approximately 9,000 institutions worldwide using Canvas, the attack rippled across higher education in the middle of finals week. UIUC was among the first R1 universities to announce a blanket finals postponement, issuing a mass email Thursday evening declaring that ALL final exams and assignments scheduled for May 8-10 were postponed. The UIUC Strategic Communications office continued to issue updates as Canvas access was progressively restored. Final exams originally scheduled for Friday, May 8 were rescheduled to Sunday, May 10 (Mother's Day) drawing widespread commentary. Instructure later confirmed that affected data was limited to names, email addresses, student ID numbers, and inter-user messages. The case illustrates a relatively new category of campus 'alert': not an emergency-notification under Clery, not a timely warning, but a Community Advisory issued at scale when a third-party technology vendor's outage cascades into the academic infrastructure. UIUC's choice to use its mass-notification email channel (rather than the Illini-Alert SMS emergency-system) is itself a Clery-classification decision: the Canvas hack was not an immediate threat to student physical safety, even as it forcibly rescheduled the academic calendar of more than 50,000 students.
Analysis
Key Findings
01UIUC was among the FIRST R1 publics to announce a blanket multi-day finals postponement in response to the Canvas ShinyHunters attack, within hours of the May 7 attack
02UIUC deliberately used its mass-email Community Advisory channel rather than Illini-Alert SMS, signaling that this was a Clery 'advisory' (informational) rather than an 'emergency notification' (immediate physical-safety threat)
03Rescheduling Friday May 8 finals to Sunday May 10 (Mother's Day) became a national news story in itself and reflected the constraint of the academic calendar (commencement loomed the following week)
04The Canvas incident represents an emerging category in this archive: vendor-driven campus advisories that affect tens of thousands of students simultaneously without involving any campus-physical-safety threat
Outcome
All finals scheduled May 8-10 at UIUC were rescheduled. May 8 finals moved to Sunday, May 10. Per Instructure, the breach exposed names, email addresses, student ID numbers, and inter-user messages but not passwords, SSNs, dates of birth, or financial information. UIUC's Strategic Communications office issued multiple updates over the following 5 days as Canvas access was restored.
Provenance
Sources
Every claim on this page is meant to be checkable. Open the links below (and the Verify this quote control under each confirmed alert) to read the original university, news, or archive page yourself. Hostnames are shown so you can see where you are going; archived copies survive when live pages move or disappear. See also our methodology.
Campus Alert Archive. "University of Illinois Urbana-Champaign: Campus alert, May 7, 2026." Incident of May 7, 2026. Added May 2026; last updated July 2026. https://campusalertarchive.com/case/university-of-illinois-canvas-finals-postponement-2026-05-07/