Canvas LMS breach: don’t ignore phishing emails right now
If your school or institution uses Canvas, this is probably worth paying attention to.
Canvas/Instructure was hit by ShinyHunters, and the group claimed it had stolen a huge amount of data from thousands of institutions. The numbers being reported vary a bit, but the claim is roughly thousands of schools and several terabytes of data.
The exposed data reportedly includes things like names, email addresses, student ID numbers, course information, enrollment details, and messages between students and teachers.
Instructure says it has not found evidence that passwords, financial details, government IDs, or dates of birth were taken. They also said they reached an agreement with the hackers and received confirmation that the stolen data was destroyed.
That sounds reassuring, but I would still be careful. The bigger issue now is phishing.
If attackers have course names, instructor names, school emails, and message context, they can send emails that look very believable. Not the usual obvious scam emails. More like:
“Your assignment was flagged”
“Canvas login required”
“Message from your instructor”
“Update your student account”
“Review your course access”
What I’d do for the next few weeks:
Don’t click Canvas links from emails. Go directly to your school’s website or Canvas login page.
Turn on MFA if you haven’t already.
Be suspicious of any email that creates urgency around assignments, grades, login issues, or account access.
If you had sensitive conversations inside Canvas, assume there is a chance they were seen.
And for official updates, use Instructure’s incident page instead of random screenshots or reposts.
Not trying to panic anyone. Just saying this is exactly the kind of breach that can lead to very convincing phishing attempts.
