Cassia County Schools has confirmed with Instructure (Canvas) about the security incidents that have taken place over the last week involving information of students and staff. Cassia School Technology team is monitoring the situation as it continues and we receive new information about it.
At this time, Instructure has Canvas online and account holders are able to log in to complete work through the interface. They have notified the district about possible data grabbed to include the following:
Names and email addresses
Student ID numbers
Messages sent within the Canvas platform to users
Instructure has informed us that they have notified the FBI, U.S. Cybersecurity and Infrastructure Security Agency (CISA), and international law enforcement partners, and engaged a leading third-party forensics firm to support their investigation. To prevent further unauthorized access, Instructure has done the following: revoked compromised credentials, rotated security keys, deployed platform-wide protections, and remediated the underlying vulnerability.
Instructure has stated there is no evidence that the following were included in the breach:
Passwords
Dates of birth
Government identifiers
Finance information
The Cassia Joint Schools Technology team has verified that Canvas only holds Names, Email addresses, and internal program IDs from PowerSchool and Canvas that do not reflect to any government identifiers. We are working with Instructure for any other guidelines to help out in this incident. Our Technology Department has Multi-Factor Authentication (MFA) on privileged accounts, is auditing administrative role assignments, and is following all protocols provided by the vendor. Our priority remains the support of our families and the continued security of our district's data. We will continue to provide updates as Instructure's (Canvas) investigation concludes and more specific information becomes available.
With all of the email phishing attacks going on, be alert for the following:
Strange logins into your school accounts
Loss of incoming mail
Emails being sent without your knowledge
Receiving emails claiming you need to verify Canvas or Google credentials
Urgent actions that look like it came from staff members
Messages that are from strange people you don’t know
Requests from people you do know to click on a link or download a file
Claims that your account has been compromised
Please reach out for help from the Technology department if you are not sure about situations like above. Remember, if you do get an email that has a request like above, do not answer in the email, give the person a call on the phone or talk in person because you may be communicating with a hacker.
For more information please select on the links below.