Phishing damage is not just one bad click. It can turn leaked context into account takeover, wire fraud, identity theft, malware, and weeks of cleanup.
Instructure says Canvas user identifying details and messages may have been involved. The biggest near-term risk is targeted phishing, not a password panic.
A breach notice is not just paperwork. If your Social Security number or other identity data was exposed, a credit freeze can make new-account fraud much harder.