Canvas data breach affecting some learning institutions
Some New Zealand universities and other tertiary and educational institutions have been affected by a data breach of the Canvas learning management system.
Canvas has been affected by a cyber incident, and some user information may have been accessed including name, email, messages to others within Canvas LMS, and names of classes or courses.
If you are affected by the data breach, see your education provider for specific advice.
If you are approached by any party asking for money in relation to this breach, do not engage. Do not click links, reply, or share passwords or multi-factor authentication (MFA) codes. Please report anything suspicious or concerning to your place of learning, and to the Police at 105.
Attacks like this can lead to phishing and extortion attempts by criminals. Be wary of emails, phone calls or messages from unfamiliar sources, asking you to do things like click links or install software.
To keep your information safe please see the following guides about what to do if you’re affected by a data breach. In particular, if you use the same password across different accounts, now is a good time to change it.
For more information on protecting yourself against data breaches, see our guides below.
What to do to protect yourself
-
Change your password immediately
If you are using the same password on Canvas and other accounts (you are not on a Single Sign On account through your education provider), change it immediately to something long, strong, and unique wherever this password is used.
-
Treat any email that mentions your education provider with caution
Never click links in emails about your grades; go directly to your education provider’s official portal instead. Stop and check before you give out any personal information. If you’re not sure about something, contact your education provider another way – by looking up their website and using the contact phone number, for example – to check first.
-
Check if your data has been breached
Use our tool How Exposed Am I?(external link) to check if your email or password has been exposed online in any other breaches.
Preparing for a future cyber security incident
Be prepared in case of a cyber security incident affecting your business or organisation. We’ve outlined some simple steps for putting in place an incident response plan.