Phishing damage is not just one bad click. It can turn leaked context into account takeover, wire fraud, identity theft, malware, and weeks of cleanup.
A breach notice is not just paperwork. If your Social Security number or other identity data was exposed, a credit freeze can make new-account fraud much harder.
Instructure says Canvas user identifying details and messages may have been involved. The biggest near-term risk is targeted phishing, not a password panic.