A cybersecurity breach involving the cloud-based Canvas platform has resulted in the potential compromise of personal data across multiple academic institutions in Australia and New Zealand.

雲端平台 Canvas 發生網路安全漏洞，導致澳洲與紐西蘭多家學術機構的個人資料可能遭到外洩。

The incident originated on May 2 (Australian time) via the unauthorized penetration of systems operated by the American firm Instructure. The breach was executed by a criminal third-party actor, targeting the Canvas learning management system, a utility utilized globally for pedagogical administration. Consequently, several entities, including the University of Technology Sydney, Flinders University, and the University of Auckland, have been notified of potential data exposure.

該事件始於 5 月 2 日（澳洲時間），是由於美國公司 Instructure 營運的系統遭到未經授權的滲透。此次攻擊由第三方犯罪分子執行，目標為全球用於教學管理的 Canvas 學習管理系統。因此，包括悉尼科技大學、弗林德斯大學及奧克蘭大學在內的多個單位，均接獲關於資料可能外洩的通知。

Regarding the nature of the compromised data, Instructure and associated institutions have indicated that the breach likely encompasses names, email addresses, student identification numbers, and internal messaging content. Conversely, there is a consensus among the affected parties—including TasTAFE and Victoria University of Wellington—that sensitive identifiers, such as government IDs, financial records, passwords, and dates of birth, remain uncompromised. Furthermore, the Vice-Chancellor of Victoria University of Wellington specified that the breach was confined to the third-party software and did not extend to the institution's independent internal systems.

關於受影響資料的性質，Instructure 及相關機構表示，此次外洩可能涵蓋姓名、電子郵件地址、學生識別碼及內部訊息內容。相反地，包括 TasTAFE 與惠靈頓維多利亞大學在內的受影響方達成共識，認為敏感識別資訊（如政府身分證件、財務記錄、密碼及出生日期）未受影響。此外，惠靈頓維多利亞大學校長指出，此次外洩僅限於第三方軟體，並未擴及至該校獨立的內部系統。

Institutional responses have focused on the mitigation of harm and the verification of data integrity. The Tasmania Department for Education, Children and Young People (DECYP) has stated that it will implement notification protocols should sensitive information be confirmed as affected. While RMIT and the Auckland University of Technology continue to monitor potential impacts, they have confirmed that Canvas remains operational. Instructure has reportedly engaged external cybersecurity specialists to conduct a forensic investigation into the breach.

各機構的應對重點在於降低損害並驗證資料完整性。塔斯馬尼亞教育、兒童及青年部 (DECYP) 表示，若確認敏感資訊受影響，將啟動通知流程。雖然 RMIT 與奧克蘭理工大學持續監控潛在影響，但已確認 Canvas 仍可正常運作。據報導，Instructure 已聘請外部網路安全專家對此次外洩事件進行數位鑑識調查。

The Canvas platform remains functional while affected universities and government departments collaborate with Instructure to determine the full extent of the data exfiltration.

Canvas 平台目前仍可運作，而受影響的大學與政府部門正與 Instructure 合作，以確定資料外洩的完整範圍。