*Update Tuesday 12 May*
Following a recent meeting between ITS, Educational Enhancement, the Data Protection Officer, and Instructure (the company behind Canvas) senior management, we wanted to provide a brief update on the Canvas platform.
Instructure has confirmed that Canvas is fully operational and safe to use. Staff and students should continue to access and use Canvas as normal.
We’re expecting further information from Instructure in the coming weeks regarding any data that may have been affected in relation to our institution. Once we have more clarity, we’ll share another update.
Thank you for your patience while we continue to work closely with our provider. We’ll keep you informed as the situation develops.
Original news article - Thursday 7 May
The University, alongside other institutions, has recently been notified that Canvas has been a victim of a data breach, resulting from a cyber-attack. The attack has now been blocked and you can continue to use Canvas as normal.
Unfortunately, the nature of the incident means that some personal data such as email addresses, and messages sent between staff and students has been taken, and this includes data from our University. At this stage we have not been informed by the team that manage Canvas what Sussex information has been taken, but once we receive this information we will contact those affected.
The investigation is still ongoing, and currently there is no indication that passwords, dates of birth, government identifiers, or financial information were taken. National bodies such as JISC and UCISA are leading the response for UK universities and our IT team is regularly reviewing the situation.
We have been assured that the attack has been blocked and that Canvas is fully operational, so you are able to continue to use it.
What does this mean for you?
You can continue to us Canvas as normal. However, this breach increases the risk of phishing scams, where people pretend to be trusted organisations to trick you into sharing information or clicking harmful links. Remember that we will never contact you to ask you to give us your password.
What you should do now
- Be extra alert for suspicious emails, texts, messages, or phone calls
- Do not click links or share information unless you are sure the message is genuine
- Report anything suspicious to IT Services
- Check that Canvas is using your Sussex email address, not a personal one. Update it if needed.
What the University is doing
The University is working closely with sector agencies and partners to investigate and manage the situation.
Advice and support
If you have questions about this email or need further support, please contact IT Services: https://www.sussex.ac.uk/its/help/
Jim Andrews
Chief Operating Officer and University Secretary