Alert: May 8
ODU continues to monitor the ongoing Instructure (Canvas) cybersecurity incident and is working closely with Instructure as additional information becomes available. Canvas services have been restored; however, intermittent disruptions or service impacts may still occur while Instructure continues its investigation and recovery efforts.
Users are encouraged to remain attentive to official University communications and report any suspicious emails, links, or unexpected Canvas-related activity.
Please continue monitoring official ODU communication channels for any important updates related to coursework, instruction, or platform availability. ODU will continue to share updates as appropriate. For the latest platform status information, please refer to the Instructure Status page.
Alert: May 7
ODU is aware of a cyber incident involving Instructure (Canvas). The reported breach potentially affects 9,000 institutions worldwide and is not unique to ODU. ODU is working with Instructure to understand the potential impact of the incident.
As a result of the incident, Canvas is temporarily offline, and ODU will work with Instructure to restore service as soon as possible. Additionally, ODU is advising all students, faculty and staff to be aware and to not click on any links or open unsolicited messages or emails that appear related to Instructure or Canvas.
ODU is actively monitoring the situation and will share relevant updates with the community.
Incident Details
Instructure, the parent company of Canvas, has notified ODU that the university was impacted by a widespread data breach affecting thousands of institutions.
Instructure informed the ODU that there is no indication that passwords, dates of birth, government identifiers, or financial information were involved in this incident. It is unclear what university data was involved, and Instructure’s investigation is ongoing.
Additionally, Instructure has engaged a third-party forensics firm for an investigation and notified law enforcement authorities. The university is actively working with Instructure to learn more about the impact of the incident and will provide updates when additional information is available.
Updates from Instructure, the parent company of Canvas, are available on their status page. We will continue to monitor the situation and will provide updates as new information emerges.
Campus Communications
Dear Faculty,
Canvas service has now been restored, and ODU continues to actively monitor the environment in coordination with Instructure following the recent cybersecurity incident impacting institutions nationwide.
While services are currently available, faculty are encouraged to take proactive steps to prepare for the possibility of future interruptions or temporary instability as Instructure continues remediation and recovery activities.
Faculty are also encouraged to regularly monitor the official Canvas/Instructure status page and ODU technology updates for the latest information:
As part of our institutional preparedness efforts, we strongly recommend the following:
Academic Flexibility and Student Support
- Continue providing reasonable flexibility regarding assignment deadlines, participation expectations, assessments, and attendance-related activities where students may have been impacted by the outage.
- Recognize that some students may have experienced temporary loss of access to course materials, assignments, grades, instructor feedback, announcements, lecture recordings, or course communications during the interruption.
- Consider contingency options for high-stakes assessments should additional interruptions occur.
Download and Retain Course Materials
Faculty are strongly encouraged to maintain local or institutionally stored backup copies of critical course materials, including:
- exported Canvas gradebooks,
- assignment instructions and rubrics,
- important announcements,
- critical course files,
- and course archives where appropriate.
Recommended resources:
Please note that Canvas course export packages are intended for archival and backup purposes only and cannot be opened like standard documents to directly view files, grades, or student submissions.
ODU IT and eLearning teams are also actively working on institution-level continuity and bulk archive solutions designed to provide long-term resiliency and ensure critical instructional content remains viewable and accessible outside of Canvas during potential service interruptions.
As these capabilities continue to evolve, additional information and guidance will be shared with the campus community.
However, for immediate operational continuity, rapid faculty access, and independent local availability of critical course information during potential interruptions, faculty are still strongly encouraged to maintain exported gradebooks and local copies of critical instructional materials where appropriate.
Instructional Continuity Communication, Collaboration, and File-Sharing Tools
ODU IT and the eLearning teams are preparing and maintaining alternative communication, collaboration, and file-sharing pathways to support instructional continuity in the event of future Canvas interruptions.
Faculty are encouraged to familiarize themselves with institutionally supported tools that may be utilized if needed, including:
- Microsoft Teams for communication, meetings, discussions, and assignment workflows,
- University Outlook Email for direct student communications,
- OneDrive for file storage and sharing,
- and Google Shared Drives for centralized file sharing and collaboration.
Faculty may also wish to review available options for downloading course roster information and preparing alternate communication methods outside of Canvas should future interruptions occur.
Resources:
Alternative Instructional and Assignment Options
If Canvas experiences additional interruptions, faculty may temporarily utilize:
- Microsoft Teams for announcements, discussions, assignment collection, and secure file sharing,
- Microsoft Teams Assignments for distributing and grading assignments,
- OneDrive or Google Shared Drives for secure file sharing and material distribution,
- and direct access to Panopto or publisher platforms where needed.
The ODU Course Collaboration Tool may also be used to provision:
- Microsoft Teams class spaces,
- Google Shared Drives,
Students are automatically granted access to the shared Microsoft Teams or Google Drive based on the class roster.
Resources:
Security Reminder
ODU also wants to reassure the campus community that authentication is fully federated through SSO and that Canvas does not store institutional passwords locally. As a result, institutional credentials and password hashes are not stored within the Canvas environment.
Faculty should continue to remain cautious regarding unsolicited emails, links, or messages appearing to reference Canvas or Instructure.
Support Resources
ODU IT, eLearning, and Collaboration Technologies teams remain available to assist faculty with:
- Teams setup and assignment workflows,
- OneDrive and Google Shared Drive usage,
- course continuity planning,
- Panopto access,
- and related instructional continuity needs.
Faculty needing assistance should continue to submit Help Desk tickets for support:
We appreciate your continued flexibility, preparedness, and partnership as we work to ensure continuity of instruction and minimize disruption for our students.
Thank you,
Academic Technologies Team
NATIONWIDE SECURITY BREACH INVOLVING CANVAS
ODU Community,
We are writing to inform you of a cybersecurity incident involving unauthorized access to certain student and staff information. You may have seen messages related to the breach in Canvas yesterday. Instructure, an international provider of education administration software (including Canvas) is currently investigating the incident, which is believed to have happened in late April and was reported to ODU on May 1. The breach was limited to Instructure’s internal systems; the security of ODU networks was not impacted.
Canvas has been temporarily disabled for students and staff to prevent further issues. We recognize the impact this has, especially at the end of the semester, and the University will support faculty and students through any issues that emerge due to this downtime. Please know that students will not be penalized for missed or late assignments because of the outage.
Instructure has reported that the following information may have been impacted:
- Names
- Email addresses
- Student ID numbers
- Private messages between users
- Course term date
- Course ID
ODU does not share any sensitive information such as date of birth, addresses, passwords, or other identifiable information within Canvas.
We have engaged legal counsel to ensure our community’s interests are protected and prioritized. Additionally, we have completed a review of our Canvas-related integrations and access controls as a proactive measure recommended by Instructure (Canvas).
ODU takes the privacy of student, staff, and faculty information very seriously. We are working to ensure Instructure directly notifies those impacted with details of the personal information affected.
Thank you for your patience as we continue to work through this matter. We are committed to keeping you informed. For up-to-date status information from Instructure (Canvas), see status.instructure.com.
Security Operations
University Information Security Office
Old Dominion University
Dear Faculty,
ODU is aware of a cyber incident involving Instructure (Canvas). The reported breach potentially affects approximately 9,000 institutions worldwide and is not unique to ODU. ODU is actively working with Instructure to better understand the scope and potential impact of the incident.
As a result of the incident, Canvas was temporarily taken offline, and ODU continues working with Instructure to ensure services are stable and secure. ODU is also advising all students, faculty, and staff to remain cautious and avoid clicking links or opening unsolicited messages or emails that appear related to Instructure or Canvas.
We also want to reassure the campus community that authentication is fully federated through SSO and that Canvas does not store institutional passwords locally. As a result, institutional credentials and password hashes are not stored within the Canvas environment.
Due to the service interruption associated with this nationwide incident, faculty are encouraged to implement temporary academic continuity measures and provide reasonable flexibility for students impacted by the outage and temporary loss of access to course resources.
Recommended temporary options include:
- providing flexibility for assignment deadlines, participation expectations, attendance-related activities, and assessments given the extended interruption and temporary inability for students to access course materials, assignment instructions, grades, feedback, and prior course communications,
- postponing high-stakes quizzes, exams, or major assignment deadlines where appropriate,
- communicating with students through official ODU email or Microsoft Teams,
- sharing course materials through SharePoint or OneDrive,
- accepting assignments through email, Microsoft Teams, OneDrive, or SharePoint shared folders as needed.
Faculty should avoid using unapproved third-party tools or sharing sensitive student information through unsecured platforms.
Additional updates, guidance, and support resources will be shared as they become available. Faculty needing assistance should submit a Help Desk ticket for support.
We appreciate your flexibility, understanding, and continued support as we work to minimize disruption for our students.
Thank you,
Brian K. Payne, PhD
Provost and Executive Vice President for Academic Affairs
Professor of Sociology and Criminal Justice
Old Dominion University