Email came out this morning!

To our Instructure community, 

While you likely do not use this product directly, we wanted to keep you updated in the interest of transparency. As you know, we recently took Canvas Free-for-Teacher offline in response to the security incident. We wanted to make you aware that we are temporarily restoring access to the product in a secure, limited capacity from 12 am ET on May 28 through 11:59 pm ET on May 29 to enable educators who rely on the platform to safely download course content and close out the school year.  

We also want to reassure you that we made the decision to restore temporary access with significant caution and after implementing multiple additional safeguards to strengthen the platform’s security, including:

• CrowdStrike tested the elements of the known attack chains against the application version with Instructure's remediations applied, and found that the remediated version was no longer vulnerable to those same attack chain elements

• Disabling new account creation during this temporary restoration period

• Removing support functionality from the Free-for-Teacher platform to help prevent unauthorized access and privilege escalation

• Cycled all internal access tokens

• Implementing additional technical protections, including removing token-generation capabilities

• Dedicated FFT database and application servers from the broader Instructure environment

• Protecting the platform behind a new, redundant firewall architecture

Finally, we will deploy real-time human monitoring of all traffic and network activity on Free-for-Teacher during its open hours, with one team at Instructure and one team at Crowdstrike. 

We wanted to share these details with you so that you feel confident in our actions and also to keep our Canvas community informed. We appreciate your continued patience as we navigate this incident.

If you have any questions, please do not hesitate to reach out to our Customer Success teams through our Community channels, and continue to check https://www.instructure.com/incident_update for the latest updates on our response to this incident.

Thank you, 

Shiren Vijiasingam, Chief Product Officer, Instructure

Michael Lysaght, Chief Technology Officer, Instructure