Is my Canvas password safe?

According to Instructure, passwords were not compromised in this breach. However, as a precaution, several universities advised users to log out of Canvas immediately. If you reuse your Canvas password elsewhere, change it on those accounts immediately.

What data was actually stolen?

Instructure confirmed the breach includes names, email addresses, student ID numbers, and messages among users. The company stated it found no evidence that passwords, dates of birth, government identifiers, or financial information were involved.

Should I pay attention to phishing emails?

Absolutely. With verified email addresses and student IDs in criminal hands, attackers can create highly convincing phishing emails. Never click links in unsolicited emails. Access Canvas directly by typing the URL into your browser.

Will my final exams be canceled?

It depends on your institution. The University of Illinois postponed finals scheduled for May 8-10. Columbia, Penn, and JMU implemented flexibility policies. Check your university's official communications for specific guidance.

What happens if the ransom isn't paid by May 12?

ShinyHunters has threatened to publish all stolen data on its leak site. Based on the group's history, this threat should be taken seriously. However, paying ransoms does not guarantee data deletion and may encourage future attacks.

Is Canvas safe to use now?

Instructure says Canvas is fully back online for most users as of May 7, 11:17 PM. However, the University of California system is keeping Canvas blocked until they are confident the system is secure. Use your institution's guidance as your primary reference.

What should I do right now to protect myself?

Three things: (1) Don't click any suspicious links claiming to be from Canvas or your school. (2) Enable two-factor authentication on all accounts if you haven't already. (3) Monitor your email for unusual login attempts or password reset requests.