Postsecondary institutes in Ontario, such as the University of Toronto, are amongst thousands of schools impacted by a cybersecurity incident involving learning software Canvas.
Instructure, Canvas’s U.S.-based parent company, first posted about the breach “by a criminal threat actor” on its website on May 1.
A post on May 2 indicated that some identifying information of Canvas users, such as names, email address, student ID numbers and messages, may have been impacted. But there was no evidence of passwords, government or financial information being taken, said Steve Proud, the company’s chief information security officer.
The company shared an update on Wednesday that Canvas is fully operational with no ongoing unauthorized activity. It noted that this would be the final update on the site regarding the incident, but that the company was in contact with impacted customers to provide support.
So far CBC News has confirmed that three Ontario schools have been affected by the breach: the University of Toronto, OCAD University and Ontario Tech University.
A U of T community update on Thursday said the university’s learning management software Quercus would be unavailable until further notice due to the cybersecurity incident. The school said that it is in contact with the company to find a resolution.
How to know if you’ve been hacked — and what you can do to protect yourself
OCAD University informed students Thursday night of a service disruption to the Canvas Cloud program due to the security incident. It said the school is actively monitoring the situation.
A notice on Ontario Tech’s website also notified students and staff of the issue, saying the school was working with Instructure’s cybersecurity specialists to monitor the situation.
The university said all systems and learning platforms are working as usual, but that any suspicious activity should be reported to the service desk.
Two schools in B.C., the University of British Columbia and Simon Fraser University (SFU), are also amongst those impacted.
An SFU spokesperson said in an email that around 9,000 learning institutions around the world have been affected by the “systems breach.”
CBC News has reached out to Instructure for comment.
