Introduction
In a recent cybersecurity incident, Instructure, the edtech company behind Canvas and other learning management systems, disclosed a data breach that exposed sensitive student and staff information. Hackers disrupted services and stole names, email addresses, student ID numbers, and user messages. If you or your institution uses Instructure's tools, understanding how to respond to such a breach is critical. This step-by-step guide will walk you through the actions you should take immediately to safeguard your personal and academic data.
Whether you are a student, teacher, or administrator, following these steps can help mitigate the damage and reduce the risk of further compromise. The breach underscores the growing vulnerability of educational platforms and the importance of proactive security measures.
What You Need
- Your login credentials for all school-related accounts (Instructure, Canvas, etc.)
- Access to a password manager (e.g., LastPass, Bitwarden, or a built-in browser tool)
- A secondary email or phone to receive security alerts
- Credit monitoring service (optional but recommended for identity theft protection)
- Contact information for your school's IT help desk or privacy officer
- Official breach notification from Instructure or your institution (if available)
Step-by-Step Guide
Step 1: Confirm the Breach Details
First, verify that the breach actually affects you. Check for official notifications from Instructure or your educational institution. Look for emails, portal messages, or public statements. In this incident, stolen data included names, email addresses, student ID numbers, and user messages. If you use Canvas or related services, assume your data may be at risk even if you haven't received a notice yet. Visit SecurityWeek or similar sources for updates on the breach scope.
Step 2: Change Your Passwords Immediately
If you have not already done so, change the password for your Instructure account (Canvas, etc.) and any other accounts that use the same or similar credentials. Use a password manager to generate a strong, unique password (at least 12 characters with a mix of letters, numbers, and symbols). Avoid reusing passwords across different platforms.
Step 3: Enable Multi-Factor Authentication (MFA)
If your institution supports MFA, enable it immediately on your Instructure account. This adds a second layer of security, such as a code sent to your phone or a biometric verification. Even if hackers have your password, MFA can block unauthorized access. Check your account settings or contact your school's IT department for instructions.
Step 4: Review Your Messages and Communication Logs
Since user messages were part of the stolen data, review your Canvas or messaging history for any sensitive discussions. If you shared personal information (addresses, phone numbers, or financial details) in those messages, note that they may be exposed. Consider deleting old messages or asking your institution to delete them from the platform. Also, watch for phishing attempts—hackers might use the stolen message content to craft convincing emails.
Step 5: Monitor Your Accounts for Suspicious Activity
Check your bank accounts, credit cards, and other online services for unauthorized transactions or login attempts. Since student ID numbers were stolen, identity thieves could use them to open accounts or apply for loans. Sign up for credit monitoring (many breach victim companies offer free services) and set alerts for new inquiries. Also monitor your school email inbox for signs of compromise.
Step 6: Contact Your Educational Institution
Reach out to your school's IT help desk or privacy office to report any concerns. Ask what additional steps they are taking to secure student data. They may provide guidance on resetting institutional passwords or accessing identity theft prevention resources. In some cases, schools may offer free credit monitoring or identity restoration services.
Step 7: Report the Breach to Relevant Authorities
If you believe your data has been misused, file a report with your country’s data protection authority (e.g., the FTC in the U.S., ICO in the UK). You can also notify your local police department if identity theft occurs. For the Instructure breach, affected users may also contact the company's security team for specific instructions.
Tips for Long-Term Protection
- Use unique passwords for every account. A password manager makes this easy.
- Regularly review your privacy settings on educational platforms.
- Freeze your credit at the three major bureaus (Equifax, Experian, TransUnion) to prevent new accounts from being opened.
- Be cautious about sharing personal details in educational messaging systems.
- Stay informed about data breaches affecting your schools or institutions—subscribe to security news.
- Backup important files locally to reduce reliance on cloud services.
By following these steps, you can minimize the impact of a data breach like the one affecting Instructure. Remember, proactive security is the best defense. Stay vigilant and don't hesitate to ask for help from your school's IT team.