Canvas is made by Utah-based Instructure. On April 29, the company detected unauthorized access to its system by a cybercriminal group known for large-scale data breaches. The attackers gained access again through a different vulnerability on May 7, briefly disrupting Canvas before Instructure took the system offline. The FBI subsequently warned about the potential for stolen information to be used in phishing, identity theft and other fraud.

Several Utah colleges and universities were affected. The Utah System of Higher Education said personally identifiable information belonging to students and instructors was disclosed. The information taken varied by institution but included names, email addresses and other information associated with Canvas accounts. Instructure said passwords, financial information, government identification numbers and dates of birth were not exposed.

Instructure later paid an undisclosed ransom to the attackers in exchange for assurances that the stolen data had been destroyed and would not be released. There is no way to independently verify whether the gang fulfilled its promise, which is why scammers could have access to unauthorized student data.

Regardless of which school or university a student attends, anyone involved in paying tuition, buying supplies or helping with other school expenses should be particularly vigilant over the next several weeks. Back-to-school scams come in many forms.

Back-to-school shopping provides plenty of opportunities for scammers. They advertise popular products at unusually low prices, sometimes using the names and logos of familiar retailers. An ad can lead to a counterfeit website designed to collect payment or personal information.

Instead of following a link in an ad on social media, in an email or text, go directly to the retailer’s website. Check the address carefully before entering payment information. A fake site may use a web address that differs from the real retailer’s by only a character. Be skeptical of prices far below what other retailers are charging, particularly for laptops and other expensive electronics.

Tuition and school fees are another target. A call, email or text may claim that tuition hasn’t been paid or that a student owes money for class supplies, sports fees or another school expense. The message may warn that the student cannot register for classes or participate in an activity until payment is made.

Don’t pay from the message or use a link it provides. Contact the school yourself using its official website, student portal or known phone number. If the request arrives by text, check the sender. Schools, universities and other institutions often send automated messages from five- or six-digit short codes rather than ordinary 10-digit phone numbers. 

College-bound students and their families also need to watch for scholarship and financial aid scams. A message may say a student has qualified for funding, then require a fee to apply, process the award or receive the money. That’s likely a scam.

FAFSA accounts are another target. The Free Application for Federal Student Aid is free, and students and parents should never share their Federal Student Aid account login information with someone offering financial aid assistance. 

Student loan scams often arrive by phone or text with offers of loan forgiveness, lower payments or other debt relief. Scammers may claim to represent a student loan center or a federal agency. Caller ID isn’t proof that the call is legitimate because scammers can make a different name or number appear on your screen with a technique called spoofing.

The FCC advises borrowers that they are not required to make student loan payments over the phone. Don’t give a caller your Federal Student Aid login, Social Security number, bank account or credit card information. If someone claims to represent a government agency, hang up and find the agency’s official website yourself.

School accounts themselves can also be used as bait. If you receive a message about your account that requires you to click on a link, don’t do it. Instead, go to your school’s official website for information. Remember that accurate account information does not guarantee the legitimacy of the sender.

If you do respond to a scam, act quickly. Contact your bank or credit card company if you sent money or provided payment information. Change any password you entered on a suspicious site, and if you use that password elsewhere, change it there too. Report the scam to the school if its name or accounts were impersonated so it can warn other students and families.

Leslie Meredith has been writing about technology for more than a decade. As a mom of four, value, usefulness and online safety take priority. Have a question? Email Leslie at asklesliemeredith@gmail.com.