Utah Schools Warn of Phishing Surge After Canvas Breach Exposes 275 Million Records

Instructure, the company behind the Canvas learning‑management system, detected unauthorized access to its environment and began notifying customers after the intrusion was contained. Forensic analysis showed that the compromised data consisted of personal information such as names, institutional email addresses and student identification numbers. No passwords, dates of birth, government‑issued identifiers or payment details were accessed.

- Approximately 275 million user records may have been involved, according to Instructure’s statement. - The breach did not expose authentication secrets or financial information. - Officials from multiple Utah districts advised recipients to treat any unsolicited email that appears to come from Canvas or their school as suspicious, especially if it requests login credentials or contains unexpected links. - Some districts temporarily suspended Canvas while others kept the service operational, reflecting varied local responses.

Attackers likely harvested the exposed contact information to launch credential‑phishing campaigns, a tactic catalogued as MITRE ATT&CK T1566.001 (Phishing: Spearphishing Attachment) or T1566.002 (Phishing: Spearphishing Link). Because no authentication secrets were taken, the primary risk is social engineering rather than direct account takeover.