Canvas just got hacked. 275 million students exposed. The 5 steps to take tonight.

May 4, 2026

By Kim Komando

If your kid does homework through Canvas, which is basically every kid in the country, this one’s for you. Stop what you’re doing. Tell every parent you know.

Canvas, made by a company called Instructure, got hit by one of the biggest school cyberattacks in history. The hacker crew ShinyHunters says they stole 3.65 terabytes of data. 

That’s 275 million students, teachers and staff at almost 9,000 schools worldwide. Names. Email addresses. Student ID numbers. And several billion private messages between students and teachers. Every chat. Every late-night homework question.

If that sounds like the kind of haul scammers dream about, that’s because it is.

🎓 Why this one is different

Most data breaches leak credit cards. This one leaks something worse. Context.

The criminals now know your kid’s name, school, teacher and what they’ve been chatting about online. That’s exactly what they need to send a phishing email that looks like it came from the principal. Or a text from “Mom’s school account” asking for your bank info. Or a fake Canvas login page that quietly steals every password your family uses.

ShinyHunters has been on a tear. This year alone, they hit Amtrak, ADT, Cisco, the European Commission and another school platform called Infinite Campus. Their pattern is the same every time. Steal the data. Post a countdown. Demand payment. Leak everything if they don’t get it.

The deadline for Canvas? May 6. That’s roughly 48 hours from today.

🔒 Lock it down tonight

Don’t wait for a notification email from your school. Do these now.

1. Change your passwords. Especially Canvas, your kid’s school portal, and any account that shares the same password (you know which ones). Make each one different. Use a password manager, so you don’t have to remember them.
   
2. Freeze your credit. This is the single best thing you can do to stop identity theft cold. It’s free, takes 10 minutes and locks crooks out from opening accounts in your name. Read my step-by-step guide here.
   
3. Turn on two-factor authentication. On your email, your kid’s email, your school accounts and your bank. Use an authenticator app, not text messages. Texts can be hijacked. More info here on my site.
   
4. Watch every email like a hawk. If anything mentions your child’s school, teacher by name or grade, treat it as guilty until proven innocent. Hover over links before clicking. Call the school directly to verify any request for money or info.
   
5. Talk to your school. Ask what data was stored in Canvas, whether they’re notifying parents and what they’re doing about it.
   

This breach isn’t your fault. But the cleanup is on you.

🗣️ TEXT/POST THIS STAT

Canvas just got hacked. 275 MILLION students, teachers and staff exposed. Names, emails, student IDs and billions of private messages stolen. Deadline to leak is May 6. Change your passwords. Freeze your credit. Forward this to every parent you know. Free playbook at GetKim.com.

---

📩 Send this to someone who has a kid using Canvas right now. (Which is basically every parent in America.)