Should staff members and all faculty change their Canvas login password after May 7th incident?

Question

Hi, everyone. I imagine that - after the worrying May 7th incident - the wise step to take here is to ask all staff members and faculty to change the password they use to access Canvas.

But do you advise me as an admin of the Canvas account in my organization to send out a message to ask the whole community using Canvas to do so?

Apologies in advance for the relatively dumb question, but I just wanted to make sure that this is the measure that you all advise to take in cases like this.

Thanks,

Guido

james_whalley · Accepted Answer

@GuidoReverdito That is a good question, but probably one best asked of your CSM and then discussed with your IT security. None of us on the user end are quite sure of the exact extent of access by the threat actor — especially when it comes to other institutions' instances. Your CSM may be able to give you a clearer picture of exactly what was accessed in your instance (if not now, then, hopefully, soon) and your IT security will have an idea of your institution's risk aversion.

Renee Carney · Accepted Answer

@GuidoReverdito

Encouraging password resets is never a bad idea - I'm sure those you are supporting understand and are willing to take the little extra step.