NZ universities hit in world cyber security breach, students’ personal details potentially exposed

Victoria University of Wellington vice-chancellor Nic Smith told the Herald “bad actors” had accessed third-party software Canvas, but not the institution’s independent system.

Several New Zealand universities have been caught in a worldwide cyber security attack after an online tool they use became the target of a data breach.

Technology company Instructure confirmed a “criminal threat actor” gained unauthorised access to Canvas, a learning management tool it operates.

The breach exposed some users’ data, including names, email addresses, student ID numbers and messages.

At this stage, Instructure does not believe birthdates, passwords, government identifiers, or financial information were impacted.

Victoria University of Wellington, Auckland University of Technology and University of Auckland were among the education institutions in New Zealand that use Canvas.

Victoria University of Wellington vice-chancellor Nic Smith told the Herald “bad actors” had accessed third-party software Canvas, but not the institution’s independent system.

“This is not a breach of our own university systems—our learning management system (which we call Nuku) and all other university systems are operating as usual without issues.

“Our cyber security team is working with the affected company, Instructure, to understand any impacts as a result of this breach and what data has been affected. At this stage no data has been released publicly.

“There is no suggestion of student assessment data being impacted. There is also no indication that passwords or single sign-on credentials have been compromised.”

An AUT spokesperson confirmed Canvas is currently operating as normal.

The university has assured students and staff there was no need to take action themselves, and that further updates would follow.

“We are actively monitoring potential impacts, taking precautions to keep AUT’s applications secure, and will continue to keep students and staff informed”, the spokesperson told the Herald.

Through a spokesperson, the University of Auckland told the Herald a cybersecurity team was working closely with Instructure to get clarity around the extent the university’s data had been affected.

“The University is taking active steps to protect its systems and maintain the security of its applications”, they said.

“Staff and students have been advised to remain vigilant and follow advice on identifying and reporting suspicious emails and messages.”