Book a session or call us - we'll handle the rest.
Austin ISD told the Texas Attorney General on October 12 that the spring Canvas breach reached 44,652 students and staff, and because no Social Security numbers were taken, the right response for an Austin family is not a credit freeze but a phishing defense built around your kid's school accounts.
The numbers arrived quietly. The district's filing with the Attorney General's data breach portal was dated October 12, 2026, a plaintiff law firm picked it up on October 13, and the trade press ran the 44,652 figure on October 16. Most of the families we talk to in Austin never saw the May notice in the first place, let alone this week's count. So here is what was taken, what it is being used for, and the concrete steps to take in the next hour.
The short version, from the district's own May 7 update: Instructure, the company that runs Canvas (which Austin ISD brands as BLEND for grades 6 through 12 and for staff), told the district on May 1 that an intruder had been inside its systems since April 25, 2026. The vendor first said no student data was involved, then on May 5 said it was.
What the intruder took, per the district:
What the district says it never gave the vendor, so it could not have been taken from this system: dates of birth, Social Security numbers and financial information. The hacking group that claimed the Canvas attack, ShinyHunters, has also claimed figures of 275 million records across roughly 8,800 schools nationwide, including the University of Texas. Those totals are the attacker's claim, not an audited count. The 44,652 is the district's, and it is the one that matters here.
A law firm's investigation page lists Social Security numbers as possibly exposed. That conflicts with the district's statement, and we have seen no official source supporting it. Until Austin ISD or the Attorney General says otherwise, work from the district's list.
A credit freeze protects a Social Security number. Nothing in this breach needs one. What a name, a school email, a student ID and a stack of private Canvas messages give an attacker is a script.
Think about what a generic scam text looks like next to one that greets your 14-year-old by name, quotes the student ID from their actual account, mentions the teacher they messaged about a late assignment in March, and says the BLEND account is locked until they confirm their password. The second one gets clicked. That is the whole value of this data set, and it is why the Department of Education's May advisory warned schools about spear phishing and social engineering as the follow-on risk.
The messages are the part people underestimate. A teenager's direct messages to a teacher, a coach or a classmate contain names of adults they trust, class periods, club schedules and sometimes a phone number. Every one of those details makes the next fake message more convincing.
Staff are in the same position with a sharper edge. A district email plus a thread of real conversations is exactly what a payroll-redirect or gift-card scam impersonating a principal is built on.
Do these in order. None of them requires calling anyone.
The password itself was not taken, but the email address now sits on a list, and a list gets tried against every service. If your student used the same password for the district account and for a game, a streaming app or Instagram, change all of them. Use a password manager so each one is different; a teenager will accept this faster than you expect once it fills the login for them.
Check the account settings for the district sign-in and for any personal Google or Apple account the student forwards school mail to. An authenticator app beats a text code. If the district account does not offer it, that is a reason to keep school mail separate from personal mail, not a reason to skip it elsewhere.
Open the mail settings and check two things: whether any rule forwards messages to an outside address, and whether the recovery phone and email are yours. A rule that quietly copies mail elsewhere is the standard way a compromised account stays compromised after a password change.
Students and staff reach BLEND through the district's portal. That becomes the family rule: never sign in to Canvas from a link in an email, a text or a chat, no matter who it appears to be from. A real lockout gets fixed by going to the portal directly. If the portal works, the message was a lie.
Spend five minutes on it. Expect a message that uses their real name and real student ID, references a real class, and asks for one of three things: a password, a code that just arrived by text, or a quick payment for a fee, a yearbook, a trip or a fine. Teach them the three refusals: no password in any message, no code read out to anyone, no payment from a link. Then tell them the one thing that defuses every scam, which is to ask you before answering.
Parents with observer access to Canvas have their own credentials. Give those the same treatment: unique password, two-factor if offered, a look at recovery details. The attacker has your child's name and class list. A fake "field trip balance due" message aimed at you is the obvious next move.
Forward phishing emails to reportphishing@apwg.org and the district, and forward scam texts to 7726, which is SPAM on the keypad and works on every US carrier. If money or a password actually left the house, report it at reportfraud.ftc.gov and tell the school.
It is still a good idea, just not because of this breach. Every Texas parent can place a freeze on a child's credit file at all three bureaus by mail, which blocks the kind of identity theft that goes unnoticed until the child applies for a student loan. If you set one up after this spring's Oracle Health notices, nothing more is needed here. If you never have, add it to the weekend list rather than the next hour.
Most of what makes a family hard to phish lives in the house, not on the district's servers. A password manager everyone in the home actually uses. Devices that install their updates. A router whose DNS has not been quietly changed so that a typed bank address lands somewhere else. Separate accounts for each person so a teenager's compromised login cannot reach a parent's tax folder.
We set these up in homes across Austin every week, and the visit usually ends with a family that can explain the rules to each other rather than one that depends on us. That is the goal. Our scam and cybersecurity protection visits cover the accounts and the router; tech tutoring is the version where a parent or a grandparent wants to be the one who understands it. If a device already looks wrong, slow, popping up warnings, or signed in somewhere it should not be, that is a troubleshooting and repair call.
If you would rather hand the whole checklist to someone, book a visit or contact us and we will walk through the accounts with you and your student at the kitchen table.
