--- title: 'Canvas Hack Puts Student Data at Risk: What to Do if Your Info Was Exposed' description: Canvas users may be victims of phishing scams after hackers say they stole millions of students' data. Here's what to do to protect yourself. authors: - name: Gabriel O. Rodriguez Cruz role: Associate Editor url: https://money.com/author/gabriel-rodriguez/ bio: Gabriel Rodríguez is an editor at Money who covers financial technology and digital security. His two main topics of expertise are identity theft protection services and crypto, specifically crypto wallet and crypto exchanges. education: University of Puerto Rico Rio Piedras at_money_since: 2018 articles: 101 covers: - Identity Theft - Banking - Business - Career Advice - Credit - Economy and Politics - Housing - Insurance - Investing - Lifestyle - Mortgages - Personal Finance - Pets - Professional Services - Retirement - Shopping - Taxes - Technology social: - https://www.linkedin.com/in/gabriel-rodriguez-cruz/ editors: - name: Kaitlin Mulhere role: Editor url: https://money.com/author/kaitlin-mulhere/ bio: Kaitlin Mulhere is an editor at Money.com. Since joining in 2015, she’s written and edited about a variety of personal finance topics, including banks, credit, student debt, saving strategies and more. education: University of Florida at_money_since: 2015 articles: 217 covers: - Identity Theft - Banking - Business - Career Advice - Credit - Credit Cards - Debt - Economy and Politics - Education - Health and Wellness - Housing - Insurance - Investing - Lifestyle - Loans - Mortgages - Personal Finance - Retirement - Shopping - Taxes social: - https://twitter.com/KMulhere - https://www.linkedin.com/in/kaitlin-mulhere-64503048/ published: '2026-05-08T19:15:09.000Z' modified: '2026-05-08T19:15:09.000Z' section: Identity Theft word_count: 765 canonical: https://money.com/canvas-hack-student-data-stolen-what-to-do/ type: Article source: structured-blocks --- > **Disclosure:** We research all brands listed and may earn a fee from our partners. Research and financial considerations may influence how brands are displayed. Not all brands are included. [Learn more](https://money.com/page/disclaimer/). ![Young kids using tablets at school to learn](https://img.money.com/2026/05/News-Canvas-Hacked.jpg) If your child's school uses Canvas — and there's a good chance it does — a cyberattack may have exposed their personal information. The popular learning management system, used by over 14 million K-12 students and 7 million college students around the country, was hit by a breach that could affect millions of students, teachers and staff members. Instructure, the Utah-based company behind Canvas, said that highly sensitive information like Social Security numbers and financial data does not appear to have been compromised. However, experts warn the stolen information could still be used to target students and their families with highly convincing phishing scams. ## What we know about the breach On May 1, Instructure disclosed it had experienced a cybersecurity breach on April 29. The company said it believed the breach had been contained by May 2, though it later acknowledged additional unauthorized activity tied to the same incident. The group claiming responsibility for the cyberattack is ShinyHunters, an infamous hacking and extortion group linked to several major data theft campaigns in recent years, including the 2024 Ticketmaster breach tied to Live Nation and a 2025 theft of data from Google cloud storage. Attackers replaced parts of the Canvas login experience Thursday with a ransom note threatening to publicly release stolen data unless payment was made by May 12. Canvas, Canvas Beta and Canvas Test were temporarily placed into maintenance mode during the disruption, which coincided with final exams at many schools. On its leak site, ShinyHunters claims the Canvas attack affected nearly 9,000 schools worldwide and exposed the data of 275 million people. Cybersecurity researchers, though, urge consumers to exercise caution, as those numbers have not been independently verified and may be exaggerated — a common tactic among financially-motivated hacking groups. Instructure said it has not found evidence that additional data was stolen during the most recent incident. ## The information that was compromised According to Instructure, the compromised information appears to include usernames, school email addresses, student ID numbers and messages exchanged through Canvas. The company says it found no evidence that passwords, dates of birth, government identifiers or financial information were involved. That's important because it lowers the immediate risk of direct identity theft. Moreover, while Canvas users don't typically upload financial information like credit card numbers to the platform, student ID numbers exposed in the breach could potentially be used to look up or access a student's financial aid profile at their institution, depending on how their school manages that information. But experts say the exposed data could still be valuable to scammers. Attackers could send highly convincing phishing emails or text messages posing as teachers, administrators or classmates. A fake message asking a Canvas user to update account information or pay a fee will look much more legitimate if it references actual teachers or classes. ## Steps students and parents can take now to protect themselves There are [lists](https://cybernews.com/security/anvas-lms-breach-universities-data-leak/) of [schools affected](https://cyberwarrior76.substack.com/p/shinyhunters-canvas-breach-with-school) by the Canvas data breach floating around. But the best way to confirm whether your school was included is to contact your college, school or district administration, or check for any official communication from Canvas or Instructure. The biggest immediate risk to you or your family is phishing. Be cautious about emails or texts claiming to come from a school or Canvas that ask you to click links, confirm passwords, open attachments or send money. Instead of using links from messages, navigate directly to your school's official website. Genuine Canvas support emails end in @instructure.com, while institutional emails or support from school IT will use their own domain, like @university.edu. Parents whose schools were affected may also want to consider [placing a credit freeze](https://money.com/how-to-freeze-your-credit/) on their child's credit file through Equifax, Experian and TransUnion. Child identity theft can go unnoticed for years because minors rarely check their credit. A freeze is free and prevents new accounts from being opened in your child's name. College students whose institutions were affected should consider doing the same. Anyone with an active credit file has something to protect. If you're concerned about broader exposure, you can also look into [identity theft monitoring services](https://money.com/best-identity-theft-protection/), which scan dark web marketplaces and data broker databases for your personal information and alert you if it surfaces. Many offer family plans that cover minors — a useful feature given that a child's data can sit dormant for years before anyone tries to exploit it. ```json { "@context": "https://schema.org", "@graph": [ { "@type": "BreadcrumbList", "@id": "https://money.com/canvas-hack-student-data-stolen-what-to-do/#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://money.com" }, { "@type": "ListItem", "position": 2, "name": "Identity Theft", "item": "https://money.com/identity-theft/" }, { "@type": "ListItem", "position": 3, "name": "Data Breach", "item": "https://money.com/data-breach/" }, { "@type": "ListItem", "position": 4, "name": "Canvas Hack Puts Student Data at Risk: What to Do if Your Info Was Exposed" } ] }, { "@type": "WebSite", "@id": "https://money.com/#website", "url": "https://money.com", "name": "Money", "publisher": { "@id": "https://money.com/#organization" } }, { "@type": "WebPage", "@id": "https://money.com/canvas-hack-student-data-stolen-what-to-do/#webpage", "url": "https://money.com/canvas-hack-student-data-stolen-what-to-do/", "name": "Canvas Hack Puts Student Data at Risk: What to Do if Your Info Was Exposed", "isPartOf": { "@id": "https://money.com/#website" }, "datePublished": "2026-05-08T19:15:09.000Z", "mainEntity": { "@id": "https://money.com/canvas-hack-student-data-stolen-what-to-do/" }, "inLanguage": "en-US", "breadcrumb": { "@id": "https://money.com/canvas-hack-student-data-stolen-what-to-do/#breadcrumb" }, "dateModified": "2026-05-08T19:15:09.000Z" }, { "@type": "Article", "headline": "Canvas Hack Puts Student Data at Risk: What to Do if Your Info Was Exposed", "articleSection": "Identity Theft", "image": [ { "@type": "ImageObject", "url": "https://img.money.com/2026/05/News-Canvas-Hacked.jpg", "width": 2307, "height": 1538, "caption": "News-Canvas-Hacked" } ], "author": [ { "@type": "Person", "name": "Gabriel O. Rodriguez Cruz", "url": "https://money.com/author/gabriel-rodriguez/", "@id": "https://money.com/author/gabriel-rodriguez/#author", "description": "Gabriel Rodríguez is an editor at Money who covers financial technology and digital security. His two main topics of expertise are identity theft protection services and crypto, specifically crypto wallet and crypto exchanges.", "image": "https://img.money.com/2020/06/Gabriel-Rodriguez-1.png?w=400&h=400&crop=1", "email": "gabriel.rodriguez@money.com", "jobTitle": "Associate Editor", "alumniOf": "University of Puerto Rico Rio Piedras", "sameAs": [ "https://www.linkedin.com/in/gabriel-rodriguez-cruz/" ], "worksFor": { "@id": "https://money.com/#organization" } } ], "publisher": "https://money.com/#organization", "datePublished": "2026-05-08T19:15:09.000Z", "description": "Canvas users may be victims of phishing scams after hackers say they stole millions of students' data. Here's what to do to protect yourself.", "abstract": "Canvas users may be victims of phishing scams after hackers say they stole millions of students' data. Here's what to do to protect yourself.", "@id": "https://money.com/canvas-hack-student-data-stolen-what-to-do/", "inLanguage": "en-US", "dateModified": "2026-05-08T19:15:09.000Z", "editor": [ { "@type": "Person", "name": "Kaitlin Mulhere", "url": "https://money.com/author/kaitlin-mulhere/", "@id": "https://money.com/author/kaitlin-mulhere/#author", "description": "Kaitlin Mulhere is an editor at Money.com. Since joining in 2015, she’s written and edited about a variety of personal finance topics, including banks, credit, student debt, saving strategies and more. ", "image": "https://img.money.com/2015/04/Kaitlin-Mulhere.png?w=226&h=247&crop=1", "email": "kaitlin.mulhere@money.com", "jobTitle": "Editor", "alumniOf": "University of Florida", "sameAs": [ "https://twitter.com/KMulhere", "https://www.linkedin.com/in/kaitlin-mulhere-64503048/" ], "worksFor": { "@id": "https://money.com/#organization" } } ], "wordCount": 765, "about": [ { "@type": "Thing", "name": "Identity theft", "sameAs": [ "https://en.wikipedia.org/wiki/Identity_theft" ] }, { "@type": "Thing", "name": "Data breach", "sameAs": [ "https://en.wikipedia.org/wiki/Data_breach" ] } ] } ] } ```