When Canvas Goes Dark, Your .imscc File Is Worthless
From the Admin side of the desk
On May 7, 2026, faculty and students across the country opened Canvas and got a ransom note from ShinyHunters, a cybercriminal extortion group, telling thousands of institutions to negotiate or watch their data get leaked. Canvas login pages at roughly 330 schools were defaced. The platform went into maintenance mode. Finals week for a lot of institutions were inaccessible.
This was actually the second hit. Instructure had confirmed a breach on May 1, said it was contained by May 2, and by May 7 ShinyHunters was back on the login page explaining, in their words, that Instructure had “ignored us and did some ‘security patches’” instead of negotiating. The whole thing ended with Instructure paying the ransom on May 12 and receiving what the group described as “shred logs” -- digital confirmation that the data was destroyed.
I’m not here to argue for or against the breach; other people covered that thoroughly. I’m here to talk about what got exposed that nobody was talking about.
The problem nobody wanted to mention out loud
When Canvas went dark on May 7, admins and faculty started reaching for their export files. Teachers may know what I’m talking about. The .imscc files you can generate from Course Export in the Settings menu. It’s the official Canvas backup format. The thing Instructure points you toward when asked about portability.
Here’s the problem with .imscc files: they’re a zip archive of XML and HTML that requires Canvas, or a compatible LMS, to interpret them. Open it with any other program and you get gibberish. You can’t read your assignment instructions, you can’t access your quiz questions, you can’t reference a rubric. The content is there, technically, in the sense that the food in your refrigerator is technically in your house even if the lights are off and you can’t find it in your kitchen.
If Canvas is offline, and Canvas is the only place that can read your course export, your data has limited use.
Faculty were asking questions during that outage that admins couldn’t answer well. Where are my quiz questions? How can I get to SpeedGrader to view my students’ essay submissions? What about grading three weeks of accumulated discussion replies? The honest answer, for most of them, was: we’ll have to wait until Canvas comes back online.
I built something because I didn’t want that to be the answer.
What CanvExporter does
CanvExporter is a Python tool that uses the Canvas API to pull course content out of Canvas and write it into files you can actually open on your desktop computer. Real files like a Microsoft Word .docx file with your assignment descriptions and quiz questions with answer keys. An Excel .csv spreadsheet with your importable rubric criteria in template form. Organized subfolders for announcements, discussions, content pages, rubrics, question banks, and uploaded files.
Make no mistake: CanvExporter is not a backup tool in the traditional sense. It won’t restore your course. It’s a content extraction tool. It answers the question what’s in this course in a format that works whether Canvas is running or not. Your quiz bank becomes an editable Word document. Your rubrics become Excel documents formatted for easy import into another course. Your discussion prompts become files you can email a colleague, print out for hard copy, or just read in a text editor.
The tool uses the public Canvas API exactly as designed. Authenticated requests, only for content the user running it has access to, rate limit compliant, nothing stored server-side. I checked it against Instructure’s Acceptable Use Policy and Canvas API Policy before the repo went public. It’s clean. And it’s cool like Fonzie.
It’s licensed Creative Commons Attribution-NonCommercial 4.0. Free to use. Credit required. Not for commercial resale.
Where it stands
The repo is live at https://github.com/techconsigliere/CanvExporter. Initial release is coming soon. I’m not shipping before it’s solid, because tools that handle course content need to be reliable or they’re worse than nothing. The README has the current status and what’s in active development.
Since the breach, I’ve already put the tool to work in ways that have nothing to do with disaster recovery. Our Civil Rights and Title IX Compliance department received a records request for content from a required employee training -- seven Canvas courses worth of material. Printing Canvas content pages directly produces formatting that’s somewhere between “unhelpful” and “cringey.” CanvExporter exported all seven courses in 35 minutes. A less-than-half-day turnaround on a compliance records request. That’s not a small thing.
I’ve also used it for faculty clients preparing their tenure evaluation packages. Their quizzes and assignment curriculum needed to be uploaded to an external platform for review. CanvExporter pulled all the course content in minutes. I picked the relevant assignment and quiz folders and sent my clients exactly what they needed. Clean files, right format, no manual transcription.
Both of those use cases happened in the normal course of the job. Not during a crisis. CanvExporter handles normal requests on a Tuesday afternoon just as well as a crisis, and can provide some insurance at the start of the academic term once all course content is updated.
I’ve also submitted proposals to present CanvExporter at EdTech conferences in Portland later this year and I’m tracking toward EDUCAUSE Seattle 2028.
If you’re a Canvas admin who lived through May 7 and thought there has to be a better answer than this -- that’s exactly why I built it. Watch this space.
Chris Powell is a Canvas LMS Administrator at Western Washington University and publishes Canvas Insider from the Admin side of the desk. The CanvExporter repository is at github.com/techconsigliere/CanvExporter.