<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:Helvetica;
panose-1:2 11 6 4 2 2 2 2 2 4;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Aptos;}
@font-face
{font-family:FluentSystemIcons;
panose-1:0 0 0 0 0 0 0 0 0 0;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:12.0pt;
font-family:"Aptos",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.EmailStyle21
{mso-style-type:personal-reply;
font-family:"Aptos",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;
mso-ligatures:none;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt">Disruptors,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Sharing an advisory that was sent to the Alaska cyber group regarding Canvas, a solution commonly used by K-12 and Higher Ed.
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Thanks,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<div>
<div>
<p class="MsoNormal"><b><span style="font-family:"Arial",sans-serif">Kevin Galusha, CISSP</span></b><o:p></o:p></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif">Cybersecurity Architect</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif">Clackamas County Technology Services</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif">(503)723-4960</span><o:p></o:p></p>
<p class="MsoNormal"><u><span style="font-family:"Arial",sans-serif;color:#0563C1"><a href="mailto:KGalusha@clackamas.us"><span style="color:#0563C1">KGalusha@clackamas.us</span></a></span></u><o:p></o:p></p>
<p class="MsoNormal"><u><span style="font-family:"Arial",sans-serif;color:#0563C1"><a href="http://www.clackamas.us/"><span style="color:#0563C1">www.clackamas.us</span></a></span></u><o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"> <span style="font-size:11.0pt"><o:p></o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> Mark Breunig <mark.breunig@alaskacybergroup.org>
<br>
<b>Sent:</b> Wednesday, May 6, 2026 1:19 PM<br>
<b>Subject:</b> Alaska Cyber Group Advisory - Canvas/Instructure Confirmed Data Breach<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="border:double #F15D22 1.0pt;padding:2.0pt 2.0pt 2.0pt 2.0pt">
<div>
<p class="MsoNormal" style="background:white"><b><span style="font-size:14.0pt;font-family:"Helvetica",sans-serif;color:black;background:white">Warning: External email. Be cautious opening attachments and links.<o:p></o:p></span></b></p>
</div>
</div>
<div class="MsoNormal" align="center" style="text-align:center;background:white">
<strong><span style="font-size:9.0pt;font-family:"Helvetica",sans-serif;color:black;background:white">
<hr size="2" width="100%" align="center">
</span></strong></div>
<p class="MsoNormal" style="margin-bottom:12.0pt;background:white"><o:p> </o:p></p>
<div class="MsoNormal" align="center" style="text-align:center;background:white">
<span style="font-size:9.0pt;font-family:"Helvetica",sans-serif;color:black">
<hr size="2" width="100%" align="center">
</span></div>
<p class="MsoNormal" style="background:white"><span style="color:black">Hi Everyone,<o:p></o:p></span></p>
<p class="MsoNormal" style="background:white"><span style="color:black"><o:p> </o:p></span></p>
<p class="MsoNormal" style="background:white"><b><span style="font-size:13.0pt;color:#363636">Alaska Cyber Group Public/Private Sector IT-Security Professional Members,</span></b><span style="font-size:13.0pt;color:#363636"><o:p></o:p></span></p>
<p class="MsoNormal" style="background:white"><span style="color:black"><o:p> </o:p></span></p>
<p class="MsoNormal" style="background:white"><span style="color:black">The following advisory is TLP
</span><b><span style="font-size:13.0pt;font-family:"Arial",sans-serif;color:black">CLEAR</span></b><span style="color:black">:<o:p></o:p></span></p>
<p class="MsoNormal" style="background:white"><span style="color:black"><o:p> </o:p></span></p>
<p class="MsoNormal" style="background:white"><span style="color:black">On May 3rd, Instructure - the developer of Canvas, a widely used learning management system - confirmed that significant data had been stolen due to a cyberattack. The hacker group ShinyHunters
has claimed responsibility. Instructure has been notifying customers confirmed to be impacted; the Alaska Cyber Group is sending this advisory out as amplifying messaging and to raise awareness to entities that utilize Canvas that are not yet aware.<o:p></o:p></span></p>
<p class="MsoNormal" style="background:white"><span style="color:black"><o:p> </o:p></span></p>
<p class="MsoNormal" style="background:white"><span style="color:black">Saturday, Instructure released the following statement:<o:p></o:p></span></p>
<p class="MsoNormal" style="background:white"><span style="color:black"><o:p> </o:p></span></p>
<div style="margin-left:30.0pt">
<p class="MsoNormal" style="background:white"><span style="color:black">"While we continue actively investigating, thus far, indications are that the information involved consists of certain identifying information of users at affected institutions, such as
names, email addresses, and student ID numbers, as well as messages among users," "At this time, we have found no evidence that passwords, dates of birth, government identifiers, or financial information were involved. If that changes, we will notify any impacted
institutions."<o:p></o:p></span></p>
</div>
<p class="MsoNormal" style="background:white"><span style="color:black"><o:p> </o:p></span></p>
<p class="MsoNormal" style="background:white"><span style="color:black">Customers are required to re-authorize access to Instructure's API for new application keys to be issued. <o:p></o:p></span></p>
<p class="MsoNormal" style="background:white"><span style="color:black"><o:p> </o:p></span></p>
<p class="MsoNormal" style="background:white"><span style="color:black">The group ShinyHunters has released the following:<o:p></o:p></span></p>
<p class="MsoNormal" style="background:white"><span style="color:black"><o:p> </o:p></span></p>
<div style="margin-left:30.0pt;margin-top:11.25pt;margin-bottom:11.25pt">
<p class="MsoNormal" style="line-height:16.8pt;background:white"><span style="color:black">"Nearly 9,000 schools worldwide affected. 275 million individuals data ranging from students, teachers, and other staff containing PII," reads the data leak site.<o:p></o:p></span></p>
</div>
<div style="margin-left:30.0pt;margin-top:11.25pt;margin-bottom:11.25pt">
<p class="MsoNormal" style="line-height:16.8pt;background:white"><span style="color:black">"Several billions of private messages among students and teachers and students and other students involved, containing personal conversations and other PII. Your Salesforce
instance was also breached and a lot more other data is involved."<o:p></o:p></span></p>
</div>
<p class="MsoNormal" style="background:white"><span style="color:black">If your organization utilizes Canvas, please follow the instructions to re-authorize access to Instructure's API for new application keys to be issued and maintain continued awareness for
updates or alerts from Instructure. If anyone believes they have been impacted but have not received any communications, please reach out to us and we can confirm whether or not they are on the list provided by ShinyHunters.<o:p></o:p></span></p>
<p class="MsoNormal" style="background:white"><span style="font-size:15.0pt;font-family:"FluentSystemIcons",serif"><o:p> </o:p></span></p>
<div>
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" width="1112" style="width:834.0pt;background:white;min-width: 100%">
<tbody>
<tr>
<td style="padding:11.25pt 0in 3.75pt 0in">
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" width="1112" style="width:834.0pt;min-width: 100%">
<tbody>
<tr>
<td style="padding:0in 0in 0in 0in">
<p class="MsoNormal" style="text-align:justify;line-height:13.8pt"><b><i><span style="font-size:13.0pt;font-family:"Arial",sans-serif;color:black">The information contained in this product is marked
</span></i></b><span style="font-size:13.0pt;font-family:"Arial",sans-serif;color:#0552D9"><a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__click.communications.cyber.nj.gov_-3Fqs-3DABB7InYiOjEsImQiOjQ4NTV9AAoAAAAAAEIdy5iJozRojFEu6tbEoU8asEcbD7wmzDgkZQfcoCj0xjRMnH7qmsJqYFR-2DQxrYLlw8a7x8wcgvmQjHh8FI1LG93P-5FBnBE3vKPdzVE&d=DwMDaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=CHF8RS5RD8ABJLdLVVal90iKCKVWbHlOkJbUV4ODBxrVwDW8JfLNzpoyCTM4eHAt&m=SKeG_hKuRxdyA0Dy_c6O2ga3Trv6oF43HbE2YzlDRwSL2hnofEXUHo8m9g3e2xFy&s=APk7SAZzKAuoSmDgeLwi3SkxWrPwz-vh7zOVEJ2Cqyk&e=" title="https://urldefense.proofpoint.com/v2/url?u=https-3A__click.communications.cyber.nj.gov_-3Fqs-3DABB7InYiOjEsImQiOjQ4NTV9AAoAAAAAAEIdy5iJozRojFEu6tbEoU8asEcbD7wmzDgkZQfcoCj0xjRMnH7qmsJqYFR-2DQxrYLlw8a7x8wcgvmQjHh8FI1LG93P-5FBnBE3vKPdzVE&d=DwMDaQ&c=euGZstcaT" id="OWA68736cfe-977f-ea0e-e615-8e12bb4f821a"><b><i><span style="color:#0552D9">Traffic
Light Protocol</span></i></b></a></span><b><i><span style="font-size:13.0pt;font-family:"Arial",sans-serif;color:black"> (TLP): CLEAR. Recipients may share this information without restriction. Information is subject to standard copyright rules.</span></i></b><span style="font-size:13.0pt;font-family:"Arial",sans-serif"><o:p></o:p></span></p>
</td>
</tr>
</tbody>
</table>
</td>
</tr>
</tbody>
</table>
</div>
<div>
<p class="MsoNormal" style="background:white"><span style="font-size:15.0pt;font-family:"FluentSystemIcons",serif"><o:p> </o:p></span></p>
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" width="1112" style="width:834.0pt;background:white;min-width: 100%">
<tbody>
<tr>
<td style="padding:3.75pt 0in 3.75pt 0in">
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" width="1112" style="width:834.0pt;background:#013C77;min-width: 100%">
<tbody>
<tr>
<td style="padding:0in 0in 0in 0in">
<p class="MsoNormal" align="center" style="text-align:center;background:#00082C">
<b><span style="font-size:15.0pt;font-family:"Arial",sans-serif;color:white">TLP: CLEAR</span></b><span style="font-size:15.0pt;font-family:"Arial",sans-serif;color:white"><o:p></o:p></span></p>
</td>
</tr>
</tbody>
</table>
</td>
</tr>
</tbody>
</table>
</div>
<p class="MsoNormal" style="background:white"><span style="color:black"><o:p> </o:p></span></p>
<p class="MsoNormal" style="background:white"><b><span style="color:black">Reporting</span></b><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal" style="background:white"><span style="color:black">The Alaska Cyber Group encourages recipients who discover signs of malicious cyber activity to contact us via either email or phone. <o:p></o:p></span></p>
<p class="MsoNormal" style="background:white"><span style="color:black"><o:p> </o:p></span></p>
<p class="MsoNormal" style="background:white"><span style="color:black">Respectfully,<o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span style="color:black"><o:p> </o:p></span></p>
</div>
<div id="Signature">
<div>
<p class="MsoNormal"><span style="color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;color:black">Mark Breunig<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;color:black">Chairman<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;color:black">Alaska Cyber Group<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;color:black">Mobile: 907-795-8150<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;color:black">Email: <a href="mailto:mark.breunig@alaskacybergroup.org">
mark.breunig@alaskacybergroup.org</a><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black"><o:p> </o:p></span></p>
</div>
</div>
</div>
</body>
</html>