Good afternoon!
With today being the last day of classes, we wanted to share some updates with the community regarding the Canvas data breach, and to provide suggestions and guidance you can take going forward.
Canvas Update:
We were notified by Instructure/Canvas, that they have paid the ransom to the hacking group - in order to protect the data, and their customers from any further harm. They believe they have verified the deletion of the data that was taken, and have been given commitments that no institution, or individual will be extorted any further. With this agreement, there appears to no longer be any immediate threat to any data being exposed. However, when dealing with these types of thieves, you will never have a guarantee.
We do not anticipate you being contacted directly at this time - BUT - If you are contacted directly by anyone claiming to have your data, we suggest you DO NOT send payment or respond to their demands. By receiving a message, it does not necessarily mean your personal information has been compromised or that the caller even has it. Threat actors often exaggerate or fabricate their access to sensitive or personal information to prompt payment. We encourage individuals to be cautious of unsolicited emails, calls, or texts claiming to be from MCAD, Canvas, law enforcement or other entities. If you are contacted, we strongly encourage you to verify the contact through known channels before responding. Call them, or use other means to verify their identity.
We understand that the immediate concern for you is determining what, if any, of your data or other sensitive information may have been exposed. At this time, we ask you to wait for formal guidance from Instructure regarding the scope of the incident and the nature of any affected data. As of now, all that has been communicated is that Student Names, Emails, Student ID#, and Messages were amongst the data taken. Instructure will not define any further data extractions until the law enforcement forensic investigation is complete. That is anticipated to take another 1-2 weeks.
If you believe you have been impacted by an attack, please file a complaint at http://ic3.gov. For more resources, visit http://fbi.gov to understand the impact of crime.
Enjoy your summer!
Respectfully,
Matthew Hoban