Security
Denison Security Blog
Find our latest public security findings and analyses, and explore recommended tools and guidance.
Read the latest from us
May 7, 2026Unplanned Canvas Outage
ITS is aware of a national Canvas service outage and is looking into the issue. Our teams are in constant contact with the service provider and are monitoring the situation in real-time. At this moment, we have no specific details regarding the duration of the outage or a definitive restoration window. We will provide updates as more information becomes available. Update: May 8, 2026 10:35am EDT At approximately 10:50pm last night (May…
May 5, 2026
Potential data breach involving Canvas
Denison is aware of a data breach involving Instructure, the parent company of Canvas, our learning management system. This reported data breach is a nationwide event affecting multiple institutions. Currently, Denison has not been notified of any direct impact to our campus. Canvas continues to be available for use by faculty, staff, and students. Updates from Instructure are available on their status page. We will continue to monitor the situation and…
March 24, 2026
Peer-organized operation disrupts BLUECRAB operations
Denison ITS, in cooperation with a number of peer institutions, identified at least ten breached accounts across these institutions which were being used to maintain persistence in computing environments, especially in email tenants and file sharing applications. Disrupting these applications was an important step in disrupting BLUECRAB’s operations. In short, we disrupted their data source by removing their access to accounts they should not have had access to. These accounts…
March 23, 2026
Duo high-risk/high-security authentication
Over the past three months, 25 Denison accounts were taken over through phishing attacks that tricked people into approving a fraudulent Duo request. While these attacks have not yet led to data loss, this type of attack increases the risk that sensitive information and systems could be compromised. Starting on Monday, March 23rd, a real-time security check will be added to the Duo login process to detect unusual login activity. If…
March 16, 2026
Malware deployed using fake software installers
While today’s world is increasingly connected, it is also a common mechanism for threat actors to deliver malicious payloads via social engineering. Maliciously crafted advertisements can be used by threat actors to deliver their malware to unsuspecting victims. In a recent set of cyberattacks affecting multiple sectors, threat actors deployed their malware as a part of a fake AI tool installer, intending to install spyware and viruses on victim computers….
March 10, 2026
Scamming via Google Calendar increasing
Denison’s cybersecurity intelligence has observed a threat actor that we now track as TANGERINECRAB attempting to steal money and financial information from victims. This scamming technique sends a Google Calendar invitation directly to your calendar, which bypasses email spam filters. By default, Google automatically adds calendar invites directly to your calendar. The attackers’ invitations appear genuine alongside your real events, classes, and meetings. The invitation sent in an email message…
Report phishing and suspicious messages
Forward suspicious messages from your Denison inbox to isitsafe@denison.edu.
Tried-and-True Guidance
Virtual private networks
Virtual private networks, or VPNs, are a special tool that allow computers to talk on specific networks over the Internet. For some context, it’s important to understand some basics how the Internet works. The Internet isn’t just one “thing.” It’s a network of networks, each of which has computers on it. The Internet facilitates the communication from a computer on one network to a computer on another network. Not all…
HTTPS: An invisible shield that protects your data
Imagine you want to send a secret message to your best friend. You could write it on a piece of paper and put it in an envelope. That’s safe because only your friend can open it. But if you wrote that message on a postcard and mailed it, anyone who handled the mail could read it. That’s basically what happens on the internet without encryption. The postcard-era Internet In the…
Protected: Writing emails that don’t look like phishing
There is no excerpt because this is a protected post.
Protected: Denison threat actor directory
There is no excerpt because this is a protected post.