Important Guidance from UMass IT Regarding the Canvas Cybersecurity Incident Jeremy Pelegrin, chief information security officer for UMass Amherst Information Technology, sent the email below to the campus community on May 11 providing special cybersecurity guidance following an incident that impacted access to the learning management software Canvas. Pelegrin also discusses the university’s efforts to protect its digital systems and the changing cybersecurity landscape in higher education in this article published recently on the IT site. Dear Campus Community: UMass Amherst, along with thousands of schools and universities worldwide, was impacted by the cyber incident experienced by a third-party vendor, Instructure (the company that provides thousands of schools with Canvas learning management software). While UMass Amherst IT has taken additional steps to protect our campus systems, I am writing to urge all students, faculty, and staff to remain vigilant in the days and weeks ahead. Instructure, the publisher of Canvas, has notified UMass Amherst that data fields involved in this Canvas incident may include usernames, email addresses, course names, enrollment information, and messages. Instructure has also informed UMass Amherst that core learning data was not compromised (i.e., course content, submissions, credentials). Additionally, please note that UMass Amherst does not store dates of birth, government identifiers, or financial information on our instance of Canvas. After an incident like this, malicious actors may see an opportunity to launch phishing attacks targeting affected communities. I encourage everyone to exercise caution and be alert to suspicious messages, emails, or phone calls. What you can do to protect yourself and the university community: - Only log into Canvas directly via the trusted links at umass.edu/it/canvas and be wary of emails or messages asking you to log into Canvas through other means. - Be cautious of emails appearing to come from Canvas, Instructure, or UMass entities