Canvas attack aftermath: What risks come next

The author describes the alleged April 2026 Canvas breach by ShinyHunters (GOLD CRYSTAL) that reportedly exfiltrated 3.65 TB of data affecting thousands of organizations, warns of likely follow-on phishing/vishing and impersonation campaigns targeting schools, students, and parents, and recommends measures such as phishing-resistant authentication (passkeys/hardware keys), stricter helpdesk identity verification, increased awareness training, monitoring for suspicious identity activity, and proactive community communication.