Information for former students and staff who had an account on the Canvas Learning Management System for the York Online degree programmes.
You may have seen in the press that Canvas was the subject of a cyber security attack. Instructure, the supplier of Canvas, has confirmed that the University of York was directly affected by this incident.
Instructure has taken steps to secure the system, investigate the breach and improve security. You can see more details on this on their latest incident update web page (or search “Instructure Incident Update & FAQs” in your browser).
What data has been affected?
Instructure has told us that the data involved includes information like usernames, email addresses, course names, enrollment information and messages. They have so far found no evidence that passwords were involved.
Instructure’s updates make reference to dates of birth, government identifiers, and financial information remaining secure; the University of York’s instance of Canvas does not hold such information.
Has the data been released publicly?
No, the data has not been released publicly. Instructure has notified us that they have reached an agreement that involves the data being returned to them and that no Instructure customers will be extorted as a result of this incident. While there is never complete certainty in dealing with cyber criminals, we feel this is a positive step.
What should I do?
Phishing attempts often increase following a cyber security event. You should always check the sender's address and be alert to any attempts to obtain information from you, or that push you to take urgent action. You should also be vigilant against 'look-a-like' phishing emails and unexpected document shares. Read the University's information on Phishing, Fraud and Scams (or search “phishing” on the University homepage).
What is the University doing?
We have been working with other UK universities in response to this situation. We have also notified the Information Commissioner’s Office that our data has been affected by the incident. To increase security further, we have implemented Duo Two-Factor Authentication on Canvas.