Further to our previous communications and recent Town Hall, we are writing to provide an update regarding the cybersecurity incident involving Instructure, the parent company of the Canvas Learning Management System (LMS).
Instructure has advised that it has reached an agreement with the unauthorized actor involved in this incident. As part of that agreement, the data involved was returned to Instructure, and Instructure has received digital confirmation that the data was destroyed. Instructure has also advised that the agreement includes a commitment that no Instructure customers will be extorted because of this incident, publicly or otherwise.
Instructure is currently reviewing the affected data and is in the process of informing schools whether their data was directly accessed during the incident. At this time, Ontario Tech has not received notification that its data was accessed.
All unauthorized access was limited to Instructure’s systems. Ontario Tech’s internal systems were not breached, and no university passwords or credentials were compromised. Our Information Technology team continues to monitor our systems, including Canvas, and is confident that the necessary security measures have been implemented to address the vulnerability and support the secure use of Canvas going forward.
While aspects of the investigation remain underway, based on the information currently available, the university considers the risk associated with this incident to be resolved.
As a matter of general practice, members of the university community are advised to remain alert for phishing emails and suspicious messages, and to avoid sharing personal information through unsolicited communications or with unknown senders.
Thank you for your patience and understanding throughout this matter.
Please direct inquiries to servicedesk@dc-ot.ca.