Campus Alert Archive
UW

Canvas service restored

AI-generated · every claim is source-linked
WAweatheremergency notificationhigh confidence
Compare →

University of Washington published an official alert update on or about 2026-05-07. Full text is preserved from the official emergency updates archive.

Alerts
1
Response
—
Killed
0
Injured
0
Institution
University of Washington
Public R1 · WA
All UW cases →
~50,000 studentsUW Alert
Official alert policy
Read when and how UW says it will use UW Alert: summarized, quoted, and analyzed.
Documented Timeline

Alert Sequence

1 message in sequence · 1 verified verbatim

Confirmed wording is transcribed character-for-character from a primary source. Use Verify this quote under each message to open that source in a new tab and compare the text yourself.

INITIAL ALERTMulti-channel
Verified verbatim3152 chars
UPDATE at 10:20 a.m. Saturday: UW Canvas access has been restored to UW users following a UWIT and independent security assessment. At this time, we have no evidence that UW NetID passwords were exposed, but out of an abundance of caution, UWIT recommends all UW Canvas users change their password. For password resets, please go to identity.uw.edu/account/resetpassword. Access to other systems and tools typically accessed through Canvas, including Parchment, Panopto, and Jupyter Notebooks, is also being restored. If your Canvas course uses other apps, such as Panopto or Office 365, you may be prompted to re-authorize access to each app for your account. This is expected; please authorize if prompted. UW users have not had access to Canvas since the outage began around 1 p.m. on Thursday. Information for students Students, if you have questions about deadlines or assignment submissions, check directly with your classroom instructor. Please note that deadlines listed in UW Canvas are from prior to the outage, and your instructor would not have had access to UW Canvas to make any changes until 10 a.m. today. Information for faculty, instructors and teaching assistants Faculty, instructors and teaching assistants may wish to modify activities, assignments and exams impacted by the outage. The following guides may be useful to faculty and instructional teams who are updating course assignments: How do I bulk update due dates and availability dates as an instructor? Classic quizzes: Once I publish a quiz, how do I grant students extra attempts? New quizzes: How do I update a quiz to allow multiple attempts? System security Instructure, the Canvas provider, has completed verification of its system security in coordination with its independent forensics partner, CrowdStrike. On May 8, CrowdStrike reported that there is no evidence that the threat actor had system-level access, installed malware nor obtained login credentials, nor that any additional data was extracted during the renewed activity on May 7. Based on the investigation so far, some education-related information including names, email addresses and messages sent within the platform may have been exposed. Additional investigation into data exposure is ongoing. CrowdStrike has found no evidence that passwords, dates of birth, government identifiers, such as Social Security Numbers, or financial information were exposed. UW Canvas does not include sensitive personal information such as Social Security Numbers, home addresses, billing information or financial aid information. We will continue to review additional information from Instructure as it becomes available and to communicate updates to the UW community. Please be mindful of an increased risk of phishing attacks. See UWIT guidance on how to identify and respond to phishing attacks and follow cybersecurity best practices. Additional information UWIT will post any future updates at the UW Canvas incident webpage and the UWIT’s Service Status website — where you can subscribe to receive email updates. Instructure has also posted information about the incident on its website.
Verify this quote
UW Alert official updateemergency.uw.edufind archived copies
Transcribed from official emergency updates archive page body.
Confirmed-verbatim recovery from live institutional source.
2026-09-21 second deep audit b45 P3 partial: page-scrape-cut-mid-sentence. Recapture full official body through restored tail. Dual html.parser+regex inner. Cap-exempt R1.
Message elements

How the first alert is built

To check this alert, Claude Opus 5.5 (an AI) read it in full 25 separate times, independently. Each read decided whether the message answers each of the six questions and gave a short reason. A final reviewer then weighed all 25 and wrote the plain-English verdict you see when you open a row. The score (for example 22/25) is how many reads agreed; the 25 individual reads are tucked underneath if you want to check them.

UPDATE at 10:20 a.m. Saturday: UW Canvas access has been restored to UW users following a UWIT and independent security assessment. At this time, we have no evidence that UW NetID passwords were exposed, but out of an abundance of caution, UWIT recommends all UW Canvas users change their password. For password resets, please go to identity.uw.edu/account/resetpassword. Access to other systems and tools typically accessed through Canvas, including Parchment, Panopto, and Jupyter Notebooks, is also being restored. If your Canvas course uses other apps, such as Panopto or Office 365, you may be prompted to re-authorize access to each app for your account. This is expected; please authorize if prompted. UW users have not had access to Canvas since the outage began around 1 p.m. on Thursday. Information for students Students, if you have questions about deadlines or assignment submissions, check directly with your classroom instructor. Please note that deadlines listed in UW Canvas are from prior to the outage, and your instructor would not have had access to UW Canvas to make any changes until 10 a.m. today. Information for faculty, instructors and teaching assistants Faculty, instructors and teaching assistants may wish to modify activities, assignments and exams impacted by the outage. The following guides may be useful to faculty and instructional teams who are updating course assignments: How do I bulk update due dates and availability dates as an instructor? Classic quizzes: Once I publish a quiz, how do I grant students extra attempts? New quizzes: How do I update a quiz to allow multiple attempts? System security Instructure, the Canvas provider, has completed verification of its system security in coordination with its independent forensics partner, CrowdStrike. On May 8, CrowdStrike reported that there is no evidence that the threat actor had system-level access, installed malware nor obtained login credentials, nor that any additional data was extracted during the renewed activity on May 7. Based on the investigation so far, some education-related information including names, email addresses and messages sent within the platform may have been exposed. Additional investigation into data exposure is ongoing. CrowdStrike has found no evidence that passwords, dates of birth, government identifiers, such as Social Security Numbers, or financial information were exposed. UW Canvas does not include sensitive personal information such as Social Security Numbers, home addresses, billing information or financial aid information. We will continue to review additional information from Instructure as it becomes available and to communicate updates to the UW community. Please be mindful of an increased risk of phishing attacks. See UWIT guidance on how to identify and respond to phishing attacks and follow cybersecurity best practices. Additional information UWIT will post any future updates at the UW Canvas incident webpage and the UWIT’s Service Status website — where you can subscribe to receive email updates. Instructure has also posted information about the incident on its website.

  • Sourcepresent25/25

    Final assessment

    Unanimous: it names "UWIT" as the office issuing the update and recommendations.

    Who is sending the alert and who is responding. People act faster on a message from a clearly identifiable, credible sender, such as a named department, the police, or a branded alert system, than on an anonymous notice. A branded signature counts.

    See all 25 individual reads
    1. present: It names 'UWIT' as the office issuing recommendations and updates.
    2. present: It cites "UWIT" and the UW community as the source of the Canvas update, identifying the sender.
    3. present: It names UWIT and the UW as the issuing office.
    4. present: It says 'UWIT recommends' password changes and cites UWIT assessments, naming the sender.
    5. present: It cites UWIT and 'a UWIT and independent security assessment', naming the sender.
    6. present: It names 'UWIT' as the office handling the incident and speaks to the UW community as the sender.
    7. present: It names UWIT and the UW as the source, saying 'UWIT recommends all UW Canvas users change their password'.
    8. present: The update names UWIT and Instructure as the organizations reporting on the incident.
    9. present: It names UWIT, which recommends password changes and posts updates, as the communicating authority.
    10. present: It says 'UWIT recommends all UW Canvas users change their password', naming the UW IT unit.
    11. present: It names 'UWIT' and the UW as the sender posting updates about the Canvas incident.
    12. present: It cites 'UWIT' and Instructure as sources of information on the Canvas incident.
    13. present: It names UWIT as the source, saying 'UWIT recommends' and 'UWIT will post any future updates'.
    14. present: It names UWIT and the UW as the source of the update.
    15. present: It names UWIT and the UW as the source of updates.
    16. present: It says 'UWIT recommends' actions and cites Instructure and CrowdStrike, identifying the university IT unit as sender.
    17. present: It names UWIT and says 'UWIT recommends', identifying the sender.
    18. present: It names "UWIT" and the UW as the authority reporting on the Canvas security incident and recommending action.
    19. present: It cites 'UWIT' recommendations and a 'UWIT and independent security assessment', identifying the source.
    20. present: It says 'UWIT recommends all UW Canvas users change their password', naming UW Information Technology as the source.
    21. present: It names 'UWIT' and the UW as issuing updates, identifying the source.
    22. present: It says 'UWIT recommends' and names UW Canvas and UWIT, identifying the issuer.
    23. present: It says 'UWIT recommends all UW Canvas users change their password', naming UW IT as the source.
    24. present: It cites "UWIT" and the University of Washington community, which identifies the sender of the update.
    25. present: It says 'UWIT recommends all UW Canvas users change their password', naming UW Information Technology as the source.
  • Hazardpresent25/25

    Final assessment

    Unanimous: it describes a Canvas security incident involving a "threat actor" and possible data exposure.

    What the threat actually is. A complete warning names the specific danger, such as a shooter, a fire, a tornado, or a gas leak, rather than a vague emergency, because people decide what to do based on what they are facing.

    See all 25 individual reads
    1. present: It describes a Canvas security incident by a 'threat actor' with possible data exposure.
    2. present: It names a security incident involving "the threat actor" and possible data exposure, a specific cyber threat.
    3. present: It names a Canvas security incident involving 'the threat actor' and possible data exposure.
    4. present: It concerns a security incident where 'the threat actor' affected Canvas and data 'may have been exposed'.
    5. present: It describes a security incident with a 'threat actor' and 'increased risk of phishing attacks'.
    6. present: It describes a Canvas outage tied to a 'threat actor' and possible data exposure.
    7. present: It describes a Canvas security incident with a 'threat actor' and possible data exposure, a specific cyber threat.
    8. present: It describes a security incident involving "the threat actor" and warns of "phishing attacks".
    9. present: It describes a security incident involving 'the threat actor' and possible data exposure, plus phishing risk.
    10. present: It describes a Canvas security incident involving 'the threat actor' and possible data exposure.
    11. present: It describes a security incident involving a 'threat actor' and 'an increased risk of phishing attacks'.
    12. present: It describes a 'threat actor' incident with possible data exposure and 'increased risk of phishing attacks'.
    13. present: It describes a Canvas outage involving a 'threat actor' and possible data exposure, a specific cyber threat.
    14. present: It describes a Canvas security incident by a 'threat actor' with possible data exposure.
    15. present: It describes a security incident involving a "threat actor" and "phishing attacks".
    16. present: It describes a Canvas security incident with a 'threat actor' and warns of 'phishing attacks', a specific cyber threat.
    17. present: It concerns a security incident involving a 'threat actor' and exposed data on UW Canvas.
    18. present: It names a Canvas security incident by a "threat actor" and warns of phishing.
    19. present: It describes a security incident by a 'threat actor' and an 'increased risk of phishing attacks'.
    20. present: It describes a security incident involving 'the threat actor' and possible data exposure, a specific cyber threat.
    21. present: It describes a security incident in which 'the threat actor' may have exposed data, a specific cyber hazard.
    22. present: It describes a security incident involving a 'threat actor' and 'data exposure', a specific cyber threat.
    23. present: It describes a Canvas outage involving 'the threat actor' and possible data exposure, a specific cybersecurity incident.
    24. present: It describes a security incident and outage with "a threat actor" and phishing risk.
    25. present: It describes a Canvas security incident involving a 'threat actor' and possible data exposure, a specific cyber threat.
  • Locationabsent0/25

    Final assessment

    All 25 reads find no location: the incident concerns an online system and no physical place is given.

    Where the threat is. Saying whether danger is in a specific building, a part of campus, or area-wide lets people judge their own proximity and choose a safe direction. Without a where, a warning is hard to act on precisely.

    See all 25 individual reads
    1. absent: The incident concerns an online system, with no physical location given.
    2. absent: It concerns the online UW Canvas platform and names no physical place.
    3. absent: It concerns an online system and names no physical place.
    4. absent: The incident concerns the online Canvas platform, with no physical place named.
    5. absent: It refers to the Canvas system, not any physical building, street, or area.
    6. absent: Only the online UW Canvas system is referenced; no physical location is named.
    7. absent: It refers to the UW Canvas system online but names no physical building or campus location.
    8. absent: The incident concerns the online UW Canvas platform, and no physical location is identified.
    9. absent: This is an online system incident; no physical building or campus area is named.
    10. absent: It concerns the UW Canvas system and names no physical building or area.
    11. absent: The incident involves the UW Canvas system, an online platform, with no physical place named.
    12. absent: It concerns the online Canvas platform and names no physical campus location.
    13. absent: It concerns the online Canvas system and names no physical building or place.
    14. absent: The incident is in the online Canvas system; no physical place or campus area is named.
    15. absent: It concerns the online Canvas system and names no physical place.
    16. absent: It concerns the online UW Canvas platform and names no physical building or area.
    17. absent: The affected place is the online Canvas system; no physical building or area is named.
    18. absent: It concerns an online system and names no physical building or area.
    19. absent: It concerns the UW Canvas system and names no physical building or area.
    20. absent: It concerns the UW Canvas online system and names no physical building or area.
    21. absent: It names only the UW Canvas system, with no physical building or area.
    22. absent: It concerns the online UW Canvas system and names no physical place.
    23. absent: The incident concerns the UW Canvas platform; no physical building or campus area is named.
    24. absent: It concerns an online system, UW Canvas, and gives no physical building, street, or campus area.
    25. absent: The incident concerns an online platform and names no physical building, street, or campus area.
  • Guidancepresent25/25

    Final assessment

    Unanimous: UWIT "recommends all UW Canvas users change their password" and asks users to be mindful of phishing.

    The protective action to take. A clear, specific instruction, such as shelter in place, evacuate, avoid the area, or run-hide-fight, drives faster and more correct protective behavior than describing the threat alone.

    See all 25 individual reads
    1. present: It recommends users 'change their password' and be mindful of phishing.
    2. present: It says UWIT "recommends all UW Canvas users change their password" and to beware of phishing attacks.
    3. present: It recommends 'all UW Canvas users change their password' and to watch for phishing.
    4. present: It recommends 'all UW Canvas users change their password' and to beware phishing.
    5. present: It says 'UWIT recommends all UW Canvas users change their password' and to be mindful of phishing.
    6. present: It says 'UWIT recommends all UW Canvas users change their password' and warns readers about phishing attacks.
    7. present: It recommends users 'change their password' and to be mindful of phishing attacks.
    8. present: UWIT "recommends all UW Canvas users change their password" and follow cybersecurity best practices.
    9. present: It recommends 'all UW Canvas users change their password' and to be mindful of phishing.
    10. present: It recommends users 'change their password' and warns them to 'be mindful of an increased risk of phishing attacks'.
    11. present: It recommends 'all UW Canvas users change their password' and to be 'mindful of an increased risk of phishing'.
    12. present: It says 'UWIT recommends all UW Canvas users change their password' and warns readers to be mindful of phishing.
    13. present: It recommends 'all UW Canvas users change their password' and to be mindful of phishing.
    14. present: It says UWIT 'recommends all UW Canvas users change their password' and to watch for phishing.
    15. present: It recommends "all UW Canvas users change their password".
    16. present: It says 'UWIT recommends all UW Canvas users change their password' and warns users to watch for phishing.
    17. present: It recommends 'all UW Canvas users change their password' and to watch for phishing.
    18. present: It says "UWIT recommends all UW Canvas users change their password", which is a protective action for recipients.
    19. present: It says 'UWIT recommends all UW Canvas users change their password' and to be mindful of phishing.
    20. present: It recommends users 'change their password' and to 'be mindful of an increased risk of phishing attacks'.
    21. present: It says UWIT 'recommends all UW Canvas users change their password' and warns about phishing.
    22. present: It says 'UWIT recommends all UW Canvas users change their password' and to be mindful of phishing.
    23. present: It recommends users 'change their password' and to 'be mindful of an increased risk of phishing attacks'.
    24. present: It says "UWIT recommends all UW Canvas users change their password," a protective action.
    25. present: It recommends users 'change their password' and warns them to be 'mindful of an increased risk of phishing attacks'.
  • Timepresent25/25

    Final assessment

    Unanimous: it is headed "UPDATE at 10:20 a.m. Saturday" and cites dates such as May 7 and May 8.

    When the message applies. A timestamp, the word now or immediately, or a phrase like until further notice tells the reader whether the danger is current and how quickly to act.

    See all 25 individual reads
    1. present: It gives 'UPDATE at 10:20 a.m. Saturday' and dates like May 8.
    2. present: It is stamped "10:20 a.m. Saturday" and cites events on May 7 and May 8.
    3. present: It is stamped 'UPDATE at 10:20 a.m. Saturday'.
    4. present: It is stamped 'UPDATE at 10:20 a.m. Saturday' and notes the outage began 'around 1 p.m. on Thursday'.
    5. present: It gives 'UPDATE at 10:20 a.m. Saturday' and 'May 8' and 'May 7'.
    6. present: It opens with 'UPDATE at 10:20 a.m. Saturday' and dates the outage from 'around 1 p.m. on Thursday'.
    7. present: It is stamped 'UPDATE at 10:20 a.m. Saturday' and cites 'On May 8'.
    8. present: It is marked "UPDATE at 10:20 a.m. Saturday" and says the outage began around 1 p.m. Thursday.
    9. present: It is labeled 'UPDATE at 10:20 a.m. Saturday' and references May 7 and May 8.
    10. present: It is stamped 'UPDATE at 10:20 a.m. Saturday' and references May 7 and May 8.
    11. present: It is stamped 'UPDATE at 10:20 a.m. Saturday' and mentions dates like 'May 8'.
    12. present: It is stamped 'UPDATE at 10:20 a.m. Saturday' and cites 'May 8'.
    13. present: It is stamped 'UPDATE at 10:20 a.m. Saturday' and cites dates like May 8.
    14. present: It is stamped 'UPDATE at 10:20 a.m. Saturday' and cites May 7 and May 8.
    15. present: It gives "10:20 a.m. Saturday" and "May 8".
    16. present: It is stamped 'UPDATE at 10:20 a.m. Saturday' and cites May 7 and May 8.
    17. present: It is stamped 'UPDATE at 10:20 a.m. Saturday' and mentions May 7 and May 8.
    18. present: It opens "UPDATE at 10:20 a.m. Saturday" and mentions dates such as May 7 and May 8.
    19. present: It says 'UPDATE at 10:20 a.m. Saturday' and cites dates May 7 and May 8.
    20. present: It is headed 'UPDATE at 10:20 a.m. Saturday' and says the outage began 'around 1 p.m. on Thursday'.
    21. present: It says 'UPDATE at 10:20 a.m. Saturday' and mentions May 7 and May 8, which convey timing clearly.
    22. present: It is marked 'UPDATE at 10:20 a.m. Saturday' and references May 7 and 8.
    23. present: It is stamped 'UPDATE at 10:20 a.m. Saturday' and says the outage began 'around 1 p.m. on Thursday'.
    24. present: It gives "10:20 a.m. Saturday" and dates such as "May 8," which convey timing.
    25. present: It is stamped 'UPDATE at 10:20 a.m. Saturday' and says the outage began 'around 1 p.m. on Thursday'.
  • Impactpresent25/25

    Final assessment

    Unanimous: it says names and messages "may have been exposed" and warns of "an increased risk of phishing attacks", stating potential consequences.

    What the hazard could do to the people in its path. Beyond naming the threat, a complete warning conveys its potential consequences or severity, such as that a tornado can level buildings or that a leak could be explosive, so recipients grasp how much danger they are in. Research on warning message content finds that a concrete impact statement helps people personalize their risk and act sooner.

    See all 25 individual reads
    1. present: It says names and messages 'may have been exposed' and warns of 'an increased risk of phishing attacks'.
    2. present: It says names, emails and messages "may have been exposed" and warns of "an increased risk of phishing attacks".
    3. present: It says personal information 'may have been exposed' and warns of 'an increased risk of phishing attacks'.
    4. present: It says names and messages 'may have been exposed' and warns of 'an increased risk of phishing attacks'.
    5. present: It says 'names, email addresses and messages... may have been exposed', conveying consequence.
    6. present: It says names and messages 'may have been exposed' and warns of 'increased risk of phishing attacks'.
    7. present: It says names, emails and messages 'may have been exposed' and warns of 'an increased risk of phishing attacks'.
    8. present: It says names, emails and messages "may have been exposed" and warns of "an increased risk of phishing attacks".
    9. present: It states names, emails and messages 'may have been exposed' and warns of 'an increased risk of phishing attacks'.
    10. present: It says names and messages 'may have been exposed' and cites 'an increased risk of phishing attacks'.
    11. present: It says 'names, email addresses and messages' 'may have been exposed', stating the potential consequence.
    12. present: It says 'names, email addresses and messages... may have been exposed', stating a consequence.
    13. present: It says 'names, email addresses and messages' 'may have been exposed' and warns of phishing risk, a stated consequence.
    14. present: It warns information 'may have been exposed' and of 'an increased risk of phishing attacks'.
    15. present: It warns information "may have been exposed" and of "an increased risk of phishing attacks".
    16. present: It warns names, email addresses and messages 'may have been exposed' and of 'an increased risk of phishing attacks'.
    17. present: It says names and messages 'may have been exposed' and warns of 'an increased risk of phishing attacks'.
    18. present: It says names and emails "may have been exposed" and warns of "an increased risk of phishing attacks".
    19. present: It says names, emails, and messages 'may have been exposed' and warns of phishing, stating harm.
    20. present: It warns that names, emails and messages 'may have been exposed' and of 'an increased risk of phishing attacks'.
    21. present: It says names and messages 'may have been exposed' and warns of 'an increased risk of phishing attacks'.
    22. present: It warns that names and messages 'may have been exposed' and of 'an increased risk of phishing attacks'.
    23. present: It warns names, emails and messages 'may have been exposed' and of 'an increased risk of phishing attacks'.
    24. present: It says information "may have been exposed" and warns of "an increased risk of phishing attacks."
    25. present: It says names, email addresses and messages 'may have been exposed' and warns of 'increased risk of phishing', stating consequences.

Coded by Claude Opus 5.5

Systematic AI judgments with visible reasoning, not human-validated codings.

About this analysis
Context

Background

Official UW Alert update archive entry for University of Washington.
Analysis

Key Findings

Official emergency updates page preserves complete multi-update alert text.
Outcome
See official update page for operational or investigation status.
Provenance

Sources

Every claim on this page is meant to be checkable. Open the links below (and the Verify this quote control under each confirmed alert) to read the original university, news, or archive page yourself. Hostnames are shown so you can see where you are going; archived copies survive when live pages move or disappear. See also our methodology.

  1. Official
    UW Canvas service restored
    emergency.uw.edu
    archived copy
Cite this case

Campus Alert Archive. "University of Washington: Canvas service restored." Incident of May 7, 2026. Added July 2026; last updated September 2026. https://campusalertarchive.com/case/university-of-washington-uw-canvas-service-restored-2026-05-07/

Download case JSON

Alert text quoted on this page remains the work of the issuing institution; the archive is a secondary source.

Tags
washingtonuwuw-alertweather
Added July 2026Updated September 2026Via ingestion