nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Security Incident report on May 1

ErnestChan

Does anyone here receive a notification from Canvas saying there was a Security Incident report on May 1? If so, is there anything a Canvas admin need to do to protect the data in our school like changing the LTI key of all the 3rd party apps we installed?

Thanks
- Ernest

Find more posts tagged with

Accepted answers

Chris

Hi @ErnestChan,

I think most, if not all, primary admins received that notice last week (I know I did). There is some info on developer key updates posted at Application Key Timestamp Notice - Instructure Community. Instructure is primarily communicating about this incident through their status page: Instructure Status - Confirmed Security Incident. I'd suggest watching the status page for future updates about this.

As a Canvas admin myself, I don't think there is any further action we need to take ourselves right now. For apps which had their inherited developer keys reset, the individual vendors may need to update they key values on their side but we just need to wait for that to happen. I'm pretty confident that Instructure will let us know if any additional measures need to be taken from our end.

I hope this info helps!

-Chris

All comments

Chris

Hi @ErnestChan,

I hope this info helps!

-Chris

ErnestChan

Thanks Chris for your info. Yes let's wait any further update from Instructure. Appreciate your wonderful insight and support!

Mikee

@ErnestChan we are proactively changing canvas internal passwords for those with higher permissions (our Admin team primarily) to limit any potential future fallout, should a user credential match (username from canvas, reused password from somewhere else).

We've also pulled and reissued where practical tokens used by those folks for API queries too.

Mikee

We've also pulled and reissued where practical tokens used by those for API

ErnestChan

I am reading this page about this data breach: https://www.bleepingcomputer.com/news/security/instructure-confirms-data-breach-shinyhunters-claims-attack/

It said:"Customers are required to re-authorize access to Instructure's API for new application keys to be issued." Did anyone receive this message from your CSM?

Thanks
- Ernest

jmagee1

Our plagiarism checker, CopyLeaks, hasn't been working for several days now. The issue is on the Canvas side, which was confirmed by Canvas Support. Any idea if this related to the data breach? I'm not getting any response from Canvas Support today and faculty are getting impatient because grades will be due shortly.

ErnestChan

In this case, It is better to reach out to the vendor of this tool for any possible solutions.

lukekm

Curious how many institutions have notified their students of this incident. Here's an example from U Mass Amherst. Has anyone else notified students? https://www.umass.edu/it/instructure-incident

Unanswered Questions

Requirements for a Developer API key
Hello, I'm building a standalone app that integrate with CanvasI) - What are the requirements (and cost if any) for receiving an API developer key issued by Instructure? - Are Instructure-issued keys enabled globally in all Canvas organizations? or will there need to be institution-by-institution enablement? Thanks
Discrepancy between Canvas UI and Server Logs (500/503 Errors)
Hi everyone, I am seeking some insight into how Canvas LMS handles HTTP errors and how they are reflected in the logs versus the user interface. We are currently observing the following behavior in our environment: Log-only errors: We are seeing 500 (Internal Server Error) and 503 (Service Unavailable) errors recorded in…
Why is the Activity.id.history Variable Empty in My LTI Integration?
I'm currently integrating an LTI tool and attempting to use the Activity.id.history https://canvas.instructure.com/doc/api/file.tools_variable_substitutions.html#activity-id-history variable, but I'm experiencing issues getting it to work properly. What I've Done: Added the Activity.id.history variable to my Developer…
LTI Variable substitution for Term SIS ID?
I looked through the LTI Variable Substitutions documentation and while there are variable substitutions available for Canvas.term.name and Canvas.term.id (which is the Canvas incremented ID like "104"), I was surprised to see there was no option for Canvas.term.sisSourceId I tried testing other possible variants that may…
Learning Mastery Gradebook: assign_outcome_order API Returns Success But Doesn't Persist Column Order
Summary:The Learning Mastery Gradebook allows drag-and-drop reordering of outcome columns, and this triggers a call to /api/v1/courses/:course_id/assign_outcome_order. The API returns 204 No Content (success), but the column order does not persist after page refresh. Steps to Reproduce: Open Learning Mastery Gradebook for…