Resolved -
Canvas has confirmed that unauthorized activity has been contained, and safeguards put in place.
In coordination with the Office of the Provost, Technology Services has restored access to all Canvas related services, and the system is available at https://canvas.tamu.edu/
Texas A&M NetIDs and passwords were not compromised. Texas A&M manages the authentication and login process for Canvas, and that information is not passed directly to Canvas.
Please continue to remain vigilant for scams or suspicious communications related to this incident. Do not:
Purchase gift cards on behalf of anyone claiming to represent the university
Provide payment information
Share passwords or Duo verification requests
Disclose personal or account information
Please remember, Texas A&M University will never ask you for your username, password or Duo verification code. If you receive a suspicious or unexpected message, verify its legitimacy by contacting Help Desk Central or your local IT support team.
A follow-up message from the Provost’s Office will be shared with faculty soon regarding academic and instructional next steps.
May 8, 14:18 CDT
Update -
Instructure continues to work towards full restoration of Canvas Instances and have declared that Canvas is now available for users. Texas A&M administrators will continue to monitor for future updates from Instructure and in the meantime have elected to continue redirecting traffic from Canvas and Canvas integrated services until full stability and information integrity can be guaranteed for all Campus Members.
The next update regarding this incident is expected to come during business hours and further information will be provided as it becomes available.
May 7, 22:45 CDT
Update -
Texas A&M administrators are continuing to monitor the Canvas outage that is still affecting schools and universities worldwide.
At this time canvas.tamu.edu has been temporarily restricted along with other services integrated to Canvas to protect user information. Howdy remains available and unaffected by this event, as well as the ability to submit grades in Howdy. Grades for graduating seniors have been successfully submitted and any remaining final submission grades can be submitted through Howdy.
Please remain vigilant for scams or suspicious communications related to this incident - Campus Members report several bad actors that are actively targeting Texas A&M University members with gift card scams and other fraudulent requests. These individuals may contact you by phone, text message or email while pretending to represent the university, faculty, Canvas, Instructure or another trusted source.
Please do not purchase gift cards on behalf of anyone claiming to represent the university, provide payment information, share passwords or other login information, or approve unexpected Duo verification requests.
If you receive a suspicious request, please verify its legitimacy by contacting your local IT support team or Help Desk Central.
May 7, 19:59 CDT
Update -
Ongoing mitigation to further protect Campus Members from the compromised Canvas instances continues. Administrators are currently identifying any remaining links that lead directly to Canvas and redirecting them towards a newly implemented Texas A&M-controlled static maintenance page.
Further updates will be provided as they become available.
May 7, 17:52 CDT
Update -
Instructure has taken steps to prevent further logins into affected Canvas instances. Texas A&M administrators have additionally redirected traffic away from canvas.tamu.edu to prevent campus members from accessing the compromised login page. Access to Canvas will remain restricted until it is confirmed safe to restore service.
As a precaution, Texas A&M has temporarily disabled systems and services that connect to Canvas, including ORCA endpoints, worker services, scheduled SQL jobs, and Canvas links within Howdy.
If you have recently entered your NetID username and password into Canvas or any Canvas-connected service during this event, it is recommended to change your password immediately.
If you are unsure of what steps to take or if you have additional concerns, immediately notify your local IT support team, Help Desk Central or report any unauthorized access incidents to security@tamu.edu.
May 7, 16:49 CDT
Update -
Instructure has taken down all instances of Canvas. The canvas.tamu.edu login has been replaced with a message stating "Canvas is currently undergoing scheduled maintenance".
Please be vigilant of other suspicious emails, calls, messages, especially those requesting personal information. Our Technology Services team members are working alongside the Office of the Provost and the vendor to help address this issue and safeguard data. Situations like this provide an ideal opportunity for bad actors to continue targeting faculty, staff and students.
DO NOT provide any information to individuals presenting themselves as representatives of Canvas or Instructure as you will not ever be contacted by the vendor directly. Never give out passwords, click on suspicious links or provide details to an unknown email, phone call or other communication. If you are unsure of the credibility of a request, immediately notify your local IT support team, Help Desk Central or report any incidents to security@tamu.edu.
We will continue to provide additional details as they become available.
May 7, 15:52 CDT
Investigating -
Administrators have received several reports that the vendor for Canvas, Instructure, has had a security compromise. Users who attempt to log in to canvas.tamu.edu will see a non-SSO login that is NOT owned by Texas A&M University.
At this time, do NOT log in to canvas.tamu.edu until the issue has been confirmed as resolved.
The vendor has confirmed that they are aware of the issue and are currently investigating.
May 7, 15:32 CDT