In light of the recently reported global security incident involving Instructure Canvas, Echo360 recommends that customers evaluate their security needs and consider disconnecting LTI 1.1 connections.
At this time, we have no evidence that any Echo360 customer integrations, credentials, or environments have been compromised, nor has Instructure indicated that partner integration credentials were accessed or exposed. Our guidance is based on prudent risk management given the current information available and the fact that the incident involved unauthorized activity within portions of the Canvas environment.
Instructure’s latest update indicates that:
- The incident originated through Free-For-Teacher accounts.
- They have no evidence of persistence or broader credential compromise.
- Free-For-Teacher accounts have now been disabled as a containment measure.
- Institutions should weigh these assurances against their own security posture and tolerance for residual risk.
We will continue monitoring updates from Instructure and will communicate any material changes in risk assessment or recommended actions as additional information becomes available via the Echo360 Status page.
This article provides Canvas administrators and Echo360 product administrators with guidance for temporarily disconnecting Canvas integrations for the following products:
For assistance, contact Echo360 Support at support@echo360.com.
What “disconnecting Canvas” means
To temporarily disconnect Canvas from Echo360 products, Canvas administrators should disable the Canvas-side integration points used by each product. Depending on the product and integration type, this may include:
- Disabling Canvas Developer Keys
- Disabling Canvas External Apps / LTI tools
- Disabling course-level Canvas navigation links where integrations were added at the course level
Where possible, Echo360 recommends disabling or deactivating integration components rather than deleting them, since this will make it easier to restore the integration later. If your institution’s security team requires deletion, document the key names, Client IDs, Deployment IDs, app names, and affected Canvas accounts or sub-accounts before deleting anything.
Disconnecting Canvas may temporarily prevent users from launching Echo360 tools from Canvas, syncing rosters, syncing grades, embedding content, accessing assignments, or passing activity data between Canvas and Echo360 products.
This action does not delete Echo360 content. All Echo360 products will continue to be accessible and function normally.
Before you begin
You must be a Canvas administrator with access to the affected Canvas account or sub-account.
Check all locations where the integration may have been installed:
- Root account
- Sub-accounts
- Individual courses, if your institution allows course-level app installs
In Canvas, most integrations can be reviewed from:
- Admin > select the account > Developer Keys
- Admin > select the account > Settings > Apps > View App Configurations
If an integration was installed at the course level, also check:
- Course > Settings > Apps > View App Configurations
- Course > Settings > Navigation
General Canvas disconnection steps
- Disable relevant Developer Keys
- In Canvas, go to Admin and select the affected account.
- Open Developer Keys.
- Search for keys related to Echo360, EchoVideo, EchoPoll, PointSolutions, and GoReact.
- For each relevant API Key or LTI Key, switch the State toggle to Off.
- Disable relevant Canvas apps
- In Canvas, go to Admin and select the affected account.
- Open Settings.
- Select the Apps tab.
- Click View App Configurations.
- Locate any Echo360 product apps.
- Use the settings or gear menu for the app to disable the tool or its placements.
- Repeat this review for sub-accounts and individual courses if your institution has installed tools outside the root account.
Relevant Canvas support articles:
Disconnect EchoVideo from Canvas
EchoVideo may use multiple Canvas integration methods, including LTI 1.1 apps, Canvas External Apps, and REST API integrations. Our recommendations for disconnecting are specific to LTI 1.1 integrations.
EchoVideo LTI apps and External Apps
In Canvas, go to:
- Admin > select the account > Settings > Apps > View App Configurations
Look for EchoVideo apps such as:
- EchoVideo
- EchoVideo Course Navigation
- EchoVideo Deep Link
- EchoVideo Deep Link Embeds
- EchoVideo Course Analytics
- My EchoVideo Library
- EchoVideo Library
- EchoVideo Homework Submission
- Any other EchoVideo app added for Canvas placements
Disable these apps or placements.
If EchoVideo apps were installed at the course level, repeat this process in the affected courses.
Relevant EchoVideo support articles:
Disconnect EchoPoll from Canvas
EchoPoll Canvas integrations may include an API Key for roster and grade data, an LTI 1.1 link, or an LTI 1.3 link. Our recommendations for disconnecting are specific to LTI 1.1 integrations.
EchoPoll API Key
In Canvas, go to:
- Admin > select the account > Developer Keys
Locate the EchoPoll API Key and switch the State toggle to Off.
This prevents the EchoPoll Canvas API integration from continuing to access Canvas.
EchoPoll LTI 1.1 app
In Canvas, go to:
- Admin > select the account > Settings > Apps > View App Configurations
Locate the EchoPoll Registration app.
Disable the app.
If EchoPoll Registration was enabled in course navigation, review affected courses:
- Course > Settings > Navigation
Move EchoPoll Registration to the disabled section if it was installed directly in the course.
Relevant EchoPoll support articles:
Disconnect PointSolutions from Canvas
PointSolutions Canvas integrations may include an API Key and an LTI Registration app.
PointSolutions API Key
In Canvas, go to:
- Admin > select the account > Developer Keys
Locate the PointSolutions API Key and switch the State toggle to Off.
PointSolutions Registration app
In Canvas, go to:
- Admin > select the account > Settings > Apps > View App Configurations
Locate the PointSolutions Registration app.
Disable the app.
If PointSolutions Registration was enabled in course navigation, review affected courses:
- Course > Settings > Navigation
Move PointSolutions Registration to the disabled section.
Relevant PointSolutions support articles:
Disconnect GoReact from Canvas
GoReact may be installed in Canvas using LTI 1.1 or LTI 1.3. Our recommendations for disconnecting are specific to LTI 1.1 integrations.
GoReact LTI 1.1
In Canvas, go to:
- Admin > select the account > Settings > Apps > View App Configurations
Locate the GoReact app.
Disable the app.
If GoReact was installed at the course level, repeat this process in affected courses.
Important: While GoReact is disconnected from Canvas, users may not be able to launch GoReact assignments from Canvas. Existing Canvas assignment links may be unavailable until the integration is restored.
Relevant GoReact support articles:
How to confirm Canvas has been disconnected
After completing the applicable steps, confirm the following:
- Relevant Canvas Developer Keys are switched Off.
- Relevant Canvas External Apps have been disabled.
- Relevant course navigation links are no longer available in Canvas.
- Users can no longer launch the affected Echo360 tool from Canvas.
- Roster, grade, assignment, analytics, or content syncs between Canvas and the affected Echo360 product are no longer running.
Reconnecting after the incident
Echo360 will continue monitoring the situation and will post updates on the Echo360 Status page.
When reconnecting, use the relevant product support articles linked above. Depending on which components were disabled, reconnecting may require re-enabling Developer Keys, re-enabling Canvas apps, or validating course-level links and assignments.
For help disconnecting or reconnecting Canvas integrations, contact support@echo360.com.