Category: Cyber Security

  • Email scams have grown more sophisticated and realistic, here are 5 ways you can still tell

    Email scams have grown more sophisticated and realistic, here are 5 ways you can still tell

    Spotting an email scam used to come with familiar advice: look for spelling mistakes, awkward sentences, and messages that sound a little off. Those clues can still help, but they are no longer enough. Criminals can use artificial intelligence to write convincing messages and correct the language errors that might otherwise give them away. The FBI has warned that these tools are making fraudulent messages more believable and easier to produce.

    For businesses, the danger often arrives looking like an ordinary part of the workday. A vendor sends an invoice, a manager requests a purchase, or an account notification asks you to confirm some information. Scammers imitate these routine interactions because the requests can seem reasonable at first glance.

    You cannot prove that every email is safe just by looking at it. However, these five warning signs can help you recognize when to stop and verify before taking action.

    1. The sender’s details do not match who they claim to be.

    A familiar display name does not establish who actually sent an email. Expand the sender’s information and examine the full email address, especially the domain after the @ symbol. Watch for substituted letters, extra characters, or an unfamiliar domain attached to the name of a company you recognize. Criminals use these small differences to make impersonation attempts look legitimate.

    Compare the address with contact information you already trust rather than relying on the signature in the message. However, even a correct address is not a guarantee of safety. Criminals can compromise genuine business email accounts and use existing conversations to make fraudulent requests seem credible. Treat the sender check as one precaution, not permission to stop checking.

    1. The message pressures you to act before you can think.

    An email threatening immediate account suspension or demanding an urgent payment deserves extra scrutiny. Scammers use urgency, fear, and intimidation to push people into acting before they investigate. The message may sound authoritative and professional while still trying to rush you into a bad decision.

    Be particularly cautious when the sender discourages you from checking with anyone else. In one impersonation scheme documented by the FBI, fraudulent invoices instructed recipients to request payment instructions by email rather than telephone, helping the scammers avoid independent verification. A request that makes it harder to confirm the facts should give you a reason to pause.

    1. The email sends you somewhere unexpected through a link, attachment, or QR code.

    A document-sharing notification or account alert may lead to a fake sign-in page rather than the service it claims to represent. Criminals can copy the appearance of legitimate websites to collect the passwords or financial information people enter. An unexpected attachment also deserves scrutiny, even when it is presented as an invoice or another routine business document.

    QR codes deserve the same caution as clickable links. The FTC warns that scammers include them in emails and text messages to direct people to fraudulent sites. For an unexpected account notice, open the service through a trusted bookmark or its official app instead of following the message’s instructions. Confirm an unexpected document with the sender through a separate, trusted contact method before opening it.

    1. The sender wants your password, sign-in code, or sensitive business information.

    A message claiming to come from technical support may sound helpful while asking you to hand over account access. Requests to reply with your password should be treated as a serious warning. Employees should not send passwords or sensitive information by email simply because a message appears to come from a manager or another trusted person.

    Be just as protective of one-time sign-in codes. Scammers may claim they need a code to investigate suspicious activity or fix an account problem, when their actual goal is to access the account themselves. Do not send someone a code used to authorize your login. Contact your IT provider or the relevant organization through an established channel to verify the request.

    1. The request changes a normal business process, especially where money is involved.

    An email does not need a malicious link or attachment to cause damage. A convincing request to send a legitimate payment to a different account can be enough. Be cautious when a vendor suddenly changes banking details, a manager requests an unusual purchase, or someone asks you to bypass the usual payment approval process. These are situations associated with business email compromise scams.

    Verify changes to payment instructions by calling a number already in your records, not a new number supplied in the email. Keep any required second approval in place, even when the request appears to come from someone senior. An existing email conversation should not replace independent confirmation when the destination of your money changes. We also have this free resource with five more items to look out for when it comes to phishing scams:

    Recognizing suspicious emails should be a shared business practice, not a test employees are expected to pass without support. Give your team a clear process for checking unusual requests and reporting concerns. Regular training and an incident response plan help turn that expectation into something people can actually follow.

    At Valley Techlogic, we help businesses strengthen their defenses with email and phishing protection, employee security awareness training, simulated phishing exercises, endpoint protection, and ongoing security monitoring. These services combine technical safeguards with practical preparation for the people using your systems every day.

    Your employees should not have to make every security decision alone. Reach out to us today to discuss your current protections and how we can help your business reduce its exposure to phishing and other online scams.

    This article was powered by Valley Techlogic, leading provider of trouble free IT services for businesses in California including Merced, Fresno, Stockton & More. You can find more information at https://www.valleytechlogic.com/ or on Facebook at https://www.facebook.com/valleytechlogic/ . Follow us on X at https://x.com/valleytechlogic

  • 6 Reasons to restrict admin access to company devices

    6 Reasons to restrict admin access to company devices

    Giving employees administrator access to their work computers can seem like an easy way to avoid interruptions. Someone needs to install a program or change a setting, and granting full access feels faster than involving IT. However, that convenience deserves a closer look before it becomes the default for every desktop and laptop in your business.

    Local administrator access gives someone the ability to authorize changes that affect the entire computer, including protected system settings and certain software installations. Most everyday work can happen through a standard user account, with administrative access reserved for tasks that actually require it. Microsoft recommends using a standard account for daily work because it provides a more secure foundation for a managed environment.

    For business owners, the goal should be to give employees the tools they need without handing them unnecessary control over the computers those tools run on. Here are six reasons to make restricted admin access part of your desktop and laptop security strategy.

    • 1. Reduce the damage malware can cause

    The permissions available to malicious software help determine what it can change on a computer. Malware that obtains administrator privileges can make system-level changes that would otherwise require additional authorization. Keeping everyday accounts at the standard-user level adds a barrier against those actions and limits opportunities for malicious code to run with elevated permissions.

    That protection should be part of a broader security plan, rather than a reason to relax other safeguards. Your business should still protect employee files, maintain backups and monitor desktops and laptops for suspicious activity.

    • 2. Put more control around software installations

    Imagine an employee downloading a free utility to solve a problem with a document or printer. Before that utility makes changes across a company computer, your IT team should have an opportunity to review whether it belongs there. Restricting admin access creates that checkpoint for installations that require system-wide changes.

    Removing admin rights does not block every program, since some applications can install within an individual user’s profile. Pairing access restrictions with application controls and an approved software process gives your business more effective oversight than relying on account permissions alone.

    • 3. Make security settings harder to weaken

    Security protections lose value when someone can casually change or disable them. Depending on how a computer is configured, administrator access can allow changes to controls intended to limit which applications run. Keeping that access restricted helps prevent employees, or software operating with their privileges, from undermining those protections.

    Access restrictions should work alongside anti-tampering features. For example, Microsoft Defender’s tamper protection blocks unauthorized changes to key antivirus settings, including real-time protection and behavior monitoring. Your IT provider should manage these controls together so security does not rely on a single account setting.

    • 4. Prevent accidental changes that interrupt work

    An employee trying to fix a computer problem may not realize how broadly a system change could affect their desktop or laptop. Administrative tasks can include installing drivers and running certain diagnostic tools, which deserve more oversight than changing a personal preference. Requiring approval for those actions gives IT a chance to review the proposed fix before it is applied.

    Consider someone following an online troubleshooting guide that recommends changing protected settings. A permission boundary creates an opportunity to stop and ask whether those instructions are appropriate for a company-managed computer. Windows’ account controls are designed to put authorization around changes that can affect system stability and security.

    • 5. Keep desktop and laptop management more consistent

    Supporting company computers becomes more manageable when IT controls how approved applications are deployed and which system-level changes are allowed. Microsoft’s guidance for fully managed computers combines standard-user accounts with centrally managed software, reserving administrative access for authorized IT personnel. That approach provides a more controlled starting point for maintaining the environment.

    For your business, the practical goal is fewer unexplained differences between computers that should perform the same work. Rather than letting each employee independently change their desktop or laptop, establish a repeatable process for software requests, configuration changes and exceptions. That gives your support team a clearer record to work from when something needs attention.

    • 6. Make privileged activity easier to approve and track

    Restricting permanent admin access creates an opportunity to handle elevated permissions through a documented approval process. Privilege management tools can allow a specific approved task to run with the necessary permissions while the employee’s everyday account remains a standard user. Tools such as Microsoft Intune Endpoint Privilege Management also provide reporting on those elevated actions.

    This gives your business a practical alternative to choosing between unrestricted access and blocking legitimate work. Employees can request the access a task needs, while IT can review the request and retain a record of what was authorized. The objective is controlled, accountable access that supports productivity without leaving unnecessary privileges available all day.

    An MSP (Managed Service Provider) like Valley Techlogic can help your business build a practical plan for securing company desktops and laptops, with access restrictions supported by ongoing maintenance, cybersecurity services and responsive employee support. Its managed IT services bring those needs together, helping your business address security without leaving employees to troubleshoot problems on their own. Reach out to us today to review your environment and discuss how better access controls can fit into a broader strategy for protecting your business.

    This article was powered by Valley Techlogic, leading provider of trouble free IT services for businesses in California including Merced, Fresno, Stockton & More. You can find more information at https://www.valleytechlogic.com/ or on Facebook at https://www.facebook.com/valleytechlogic/ . Follow us on X at https://x.com/valleytechlogic

  • Can Password Managers Be Hacked? Our 3 Best Password Manager Recommendations

    Can Password Managers Be Hacked? Our 3 Best Password Manager Recommendations

    Password managers have become one of the most important cybersecurity tools available to individuals and businesses. They make it practical to create a unique, complex password for every account without having to memorize hundreds of credentials.

    But because a password manager stores so much sensitive information, it is reasonable to ask an important question:

    Can password managers be hacked? The honest answer is yes. Any software, device, or online service can potentially be attacked. However, that does not mean using a password manager is more dangerous than managing passwords yourself.

    For most people and businesses, the opposite is true. A reputable password manager dramatically reduces the risks created by weak passwords, password reuse, spreadsheets, browser notes, sticky notes, and credentials shared through email or text messages.

    How does a password manager protection your passwords? A properly designed password manager encrypts your vault before sending it to the provider’s servers. The provider should not possess the information needed to decrypt your stored passwords.

    This approach is often described as zero-knowledge encryption. Your vault can be synchronized between devices, but its contents remain encrypted until you unlock it with your master password or another approved authentication method.

    That does not make a password manager invincible. An attacker could still attempt to:

    • Steal your master password through phishing, malware, or social engineering
    • Access an already unlocked computer, phone, or browser session
    • Exploit a vulnerability in the password manager’s application or browser extension
    • Compromise the provider’s infrastructure and steal encrypted vault data
    • Trick an employee into approving a fraudulent multifactor authentication request

    The biggest practical risk is usually not someone breaking the encryption itself. It is an attacker stealing the user’s master password, compromising their device, or convincing them to approve access. Is it still safer to use a password manager?Yes, since people tend to reuse the same password across multiple websites or make minor variations that are easy for attackers to predict when they don’t use one. When one website is breached, criminals can test the stolen password against email, banking, Microsoft 365, social media, and other services.

    A password manager allows every account to have a long, random, and completely unique password. If one website is compromised, the stolen password cannot be reused to access your other accounts. Password managers also makes it easier to identify reused passwords, detect known compromised credentials, securely share business accounts, and revoke access when an employee leaves.

    The goal is not to eliminate every possible risk, there is no product that can promise that. The goal is to replace unsafe password habits with a system that is considerably harder to compromise.

    So, what are our password manager recommendations? Valley Techlogic recommends Bitwarden, 1Password, and Proton Pass. We feel it’s notable that of August 2026, none of these providers has publicly reported a breach that exposed customers’ decrypted password vaults. All three use strong encryption and have undergone independent security reviews. The best choice depends on your budget, technical requirements, privacy preferences, and the people who will be using it.

    1. Bitwarden

    Bitwarden is an established open-source password manager with options for individuals, families, and businesses. Its source code can be inspected publicly, and the company conducts recurring third-party security audits, source-code assessments, and penetration testing.

    Pros

    • Open-source applications and server components provide a high degree of transparency
    • Strong free plan and reasonably priced paid options
    • Available on major browsers, computers, and mobile devices
    • Supports business collections, secure credential sharing, and administrative controls
    • Can be self-hosted by organizations with the expertise to maintain it securely
    • Includes reports for weak, reused, and exposed passwords

    Cons

    • The interface is functional but may feel less polished than 1Password
    • Some administrative and reporting features require a paid business plan
    • Self-hosting adds significant maintenance and security responsibility
    • New or less technical users may need additional training during deployment

    Best for: Cost-conscious businesses, technical teams, open-source advocates, and organizations that want flexible deployment options.

    2. 1Password

    1Password is known for its polished interface and approachable user experience. In addition to your account password, it uses a locally generated Secret Key that strengthens the encryption of your vault. The company states that it has not experienced a breach of its password-management service. During the 2023 Okta support-system incident, 1Password detected suspicious activity involving its employee-facing Okta environment but reported that no user data or sensitive systems were compromised.

    Pros

    • Excellent interface that is easy for nontechnical users to understand
    • Secret Key provides additional protection beyond the account password
    • Strong family and business-sharing features
    • Useful administrative controls for onboarding and offboarding employees
    • Travel Mode can temporarily remove selected vaults from a device
    • Watchtower identifies compromised websites, vulnerable passwords, and other security concerns

    Cons

    • No permanent free plan for general password-manager use
    • Typically costs more than Bitwarden
    • The complete product is not open source
    • Users must protect both their account password and Emergency Kit containing the Secret Key

    Best for: Businesses that prioritize ease of use, employee adoption, polished administration, and a low-friction user experience.

    3. Proton Pass

    Proton Pass is part of Proton’s privacy-focused ecosystem, which also includes Proton Mail, Proton VPN, Proton Calendar, and Proton Drive. Proton Pass is open source, uses end-to-end encryption, and has undergone independent security testing by Cure53. Its audit covered the mobile applications, browser extensions, and API.

    Pros

    • Open-source applications with publicly available security information
    • Strong privacy focus and end-to-end encryption
    • Clean, modern interface
    • Integrates well with other Proton services
    • Supports email aliases that can reduce spam and limit account tracking
    • Competitive free and paid options

    Cons

    • Newer than Bitwarden and 1Password, with a shorter operational history
    • Business-management features may not be as mature as more established competitors
    • Organizations already standardized on another email or identity ecosystem may receive less benefit from Proton integration
    • Some advanced features require a paid Proton subscription

    Best for: Privacy-conscious individuals, Proton customers, small businesses, and users who value encrypted email aliases alongside password management.

    You may be wondering which of these three you should choose for your business. For many businesses, 1Password offers the smoothest user experience and may require the least training. Bitwarden is an excellent choice for businesses that want strong security, open-source transparency, and competitive pricing. Proton Pass is particularly attractive for privacy-focused users and organizations that already use, or plan to use, other Proton services.

    The most important factor is not choosing the theoretically perfect password manager. It is selecting a reputable product that your team will actually use consistently.

    So how can you use a password manager safely? A password manager should be part of a broader account-security strategy. Simply installing one is not enough. Use a long and unique master password that has never been used anywhere else. A memorable passphrase made from several unrelated words is generally easier to remember and more difficult to guess than a short, complicated password.

    Enable multifactor authentication on the password-manager account. Whenever possible, use a passkey, hardware security key, or authenticator application instead of SMS. Keep computers, phones, browsers, and password-manager applications updated. Avoid installing unnecessary browser extensions, and use reputable endpoint-security software to reduce the risk of credential-stealing malware.

    Businesses should also establish procedures for securely sharing credentials, removing former employees, reviewing administrative access, and recovering accounts when an authorized user loses access. Password managers can be attacked, just like email providers, banks, cloud platforms, and other online services. That is not a good reason to avoid them.

    A reputable password manager stores your credentials in an encrypted vault and makes it possible to use a different random password for every account. This protects you from one of the most common causes of account compromise: reused credentials.

    Bitwarden, 1Password, and Proton Pass are all strong options with different advantages. None can guarantee that an attack will never occur, but each offers a substantially safer approach than reused passwords, shared spreadsheets, browser notes, or credentials passed between employees through email.

    Valley Techlogic can help your organization select, configure, and deploy a password manager that fits your staff, security requirements, and budget. We can also help establish secure onboarding, offboarding, multifactor authentication, and credential-sharing procedures so the password manager becomes part of a complete security program rather than another unused application. Learn more today with a consultation.

    This article was powered by Valley Techlogic, leading provider of trouble free IT services for businesses in California including Merced, Fresno, Stockton & More. You can find more information at https://www.valleytechlogic.com/ or on Facebook at https://www.facebook.com/valleytechlogic/ . Follow us on X at https://x.com/valleytechlogic

  • DKIM? DMARC? How to stop scammers from using your company’s domain for nefarious purposes

    DKIM? DMARC? How to stop scammers from using your company’s domain for nefarious purposes

    You have probably heard the terms SPF, DKIM, and DMARC thrown around during conversations about email security. They sound technical, and it can be tempting to assume they are only relevant to large companies or IT departments.

    In reality, these protections matter to every business that uses email. Without them, scammers may be able to send fraudulent messages that appear to come from your company’s domain. They can impersonate executives, request payments, distribute malware, or trick customers into revealing sensitive information.

    Even if fraudulent email never touches your actual email system, your company’s name and reputation can still take the hit. Starting with DMARC, which stands for Domain-based Message Authentication, Reporting, and Conformance.

    DMARC works alongside two other email authentication technologies:

    • SPF, or Sender Policy Framework, identifies which servers are authorized to send email for your domain.
    • DKIM, or DomainKeys Identified Mail, adds a digital signature that helps prove an email was authorized and was not altered in transit.

    Together, these technologies give receiving email systems a way to determine whether a message claiming to be from your domain is legitimate.

    So how does domain spoofing work?Email was not originally designed with strong identity verification. In many cases, a scammer can place your company’s domain in the visible “From” field of an email without gaining access to your Microsoft 365, Google Workspace, or other email account.

    To the recipient, the message may appear to come from:

    The scammer might then request a wire transfer, send a fake invoice, ask an employee to purchase gift cards, or direct a customer to a fraudulent login page. This is known as domain spoofing. It is different from an attacker breaking into an actual mailbox, but it can still be extremely damaging.

    Next, SPF is a DNS record that lists the email services allowed to send messages on behalf of your domain.

    For example, if your company uses Microsoft 365, your SPF record should authorize Microsoft’s mail servers. If you also use a marketing platform, ticketing system, or invoicing application, those systems may need to be included as well. When a receiving mail server gets a message claiming to come from your domain, it can compare the sending server against your SPF record.

    A properly configured SPF record helps identify unauthorized senders. However, SPF alone is not enough. It can fail when messages are forwarded, and it does not always protect the address users see in the From field.

    Lastly, DKIM adds a cryptographic signature to outgoing email.

    The sending platform uses a private key to sign the message. The matching public key is published in your domain’s DNS records. Receiving systems can use that public key to verify that the message was authorized by your domain and that important parts of the email were not modified after it was sent.

    DKIM is especially important for cloud email platforms and third-party services that send email on your behalf.

    If your company uses services such as email marketing tools, billing platforms, customer relationship management systems, or help desk software, each service may require its own DKIM configuration. DMARC brings SPF and DKIM together and tells receiving email systems what to do when authentication fails.

    A DMARC policy can instruct the receiving system to:

    • Deliver suspicious messages to spam or quarantine
    • Reject unauthorized messages completely

    DMARC also provides reporting. These reports can show which systems are sending email using your domain and whether those messages are passing authentication. This visibility is extremely valuable. It can help uncover forgotten applications, configuration problems, and unauthorized attempts to impersonate your business.

    Many companies publish a DMARC record with a monitoring-only policy and never move beyond it. A monitoring policy is a good starting point, but it does not instruct receiving mail systems to block spoofed messages. It mainly collects information. Businesses are often hesitant to enforce DMARC because they are concerned about accidentally blocking legitimate email. That concern is valid.

    A company may have several systems sending email, including:

    • Microsoft 365 or Google Workspace
    • Marketing, accounting, support, scheduling, and website platforms

    If those systems are not identified and configured correctly, moving directly to a strict DMARC policy can cause legitimate messages to fail. The right approach is to monitor first, fix authentication issues, and then gradually increase enforcement. A proper implementation usually happens in stages.

    First, your IT provider should inventory every platform that sends email using your domain. SPF and DKIM should then be configured for each legitimate service.

    Next, DMARC reporting should be enabled so your team can review authentication results and identify unknown senders.

    Once legitimate traffic is consistently passing authentication, the DMARC policy can be moved from monitoring to quarantine. After additional review, it can be changed to reject. This staged approach reduces risk while steadily improving protection.

    There are common pitfalls to implementing these protections in your business. One of the most common mistakes is having multiple SPF records. A domain should generally have only one SPF record, with all authorized senders included in that record. Another common problem is exceeding SPF lookup limits. Adding too many services can cause SPF validation to fail, even when the record appears correct. Other issues include expired DKIM keys, marketing systems that were never authenticated, and DMARC records that remain in monitoring mode for years.

    Email authentication is not a one-time project. It should be reviewed whenever your company adds or removes a system that sends email. Does DMARC stop every scam email ? No, no single technology stops every threat.

    DMARC is highly effective at reducing direct domain spoofing, but attackers may still register lookalike domains. For example, they could replace a letter in your company name or add a word such as “billing” or “support.” Attackers can also compromise real employee mailboxes through phishing, stolen passwords, or weak multifactor authentication.

    That is why DMARC should be part of a broader email security strategy that includes:

    • Multifactor authentication and strong account security
    • Employee training, email filtering, and ongoing monitoring

    DMARC protects your domain’s identity. It does not replace the need to secure the accounts and people using it. When scammers impersonate your domain, the damage can extend beyond a single fraudulent email. Customers may lose confidence in your company. Employees may become hesitant to trust legitimate messages. Vendors may question payment requests, and your domain’s reputation may suffer with major email providers.

    SPF, DKIM, and DMARC help prove that legitimate email is really coming from your business. They also make it much harder for attackers to use your domain as a disguise.

    Valley Techlogic can review your current email authentication setup, identify unauthorized sending sources, configure SPF and DKIM correctly, and help move your DMARC policy toward full enforcement without disrupting legitimate email. Do not wait until a customer receives a fake invoice or an employee responds to a fraudulent executive request. Protect your domain before a scammer decides to use it, reach out for a consultation today to get started.

    This article was powered by Valley Techlogic, leading provider of trouble free IT services for businesses in California including Merced, Fresno, Stockton & More. You can find more information at https://www.valleytechlogic.com/ or on Facebook at https://www.facebook.com/valleytechlogic/ . Follow us on X at https://x.com/valleytechlogic

  • The Pentagon announced an ‘immediate suspension’ of CMMC phase II requirements, what this means and how to proceed

    The Pentagon announced an ‘immediate suspension’ of CMMC phase II requirements, what this means and how to proceed

    The Department of Defense (now War under President Trump) announced this week they’re suspending all Cybersecurity Maturity Model Certification (CMMC) Phase II requirements effectively immediately. The requirements were originally scheduled to come into effect November 10th, 2026, these requirements would have required the DoD to be involved in third-party cybersecurity assessments involving sensitive but classified data. Phase requirements that require a CMMC self-assessment and began last November will stay in place as of the time being.

    The Pentagon announced they will be doing a “top-to-bottom” review of the CMMC certification program over the next 60 days, the memo released by DoD Chief Information Officer Kristin Davies suggests that the program has come into conflict with Defense Secretary Pete Hegseth’s initiatives to eliminate government bureaucracy and enable more innovation by removing guardrails.

    “The current iteration of the Cybersecurity Maturity Model Certification (CMMC) program, while intended to enhance security, imposes significant and often prohibitive burdens on the Defense Industrial Base (DIB), particularly the small and non-traditional businesses that are the engine of American innovation,” Davies wrote. “While cybersecurity is essential, administrative compliance cannot come at the cost of warfighting capability and industrial base growth.” – DoD Chief Information Officer Kristin Davies

    In addition to removing the November deadline for third-party assessments the memo suspends all pending and future CMMC milestones “until further notice”.  Before this announcement some DoD offices had already began conducting third-party assessments in advance. It’s clear from the memo that this move is intended to remove hindrances from DIB contractors and speed up innovation and capacity within that base to further the goals of the current administration.

    However, this change has left many defense contractors uncertain how to proceed. The CMMC program in general has experienced a host of changes since it’s inception in 2010 under an executive order from President Obama. It’s goal was to provide a standard for cyber security for defense contractors who handle controlled unclassified data (CUI) and it wasn’t until 2019 that development on the program actually began.

    Self-attestation was originally only meant for very small contractors handling limited CUI while larger contractors and more complete DoD contracts would eventually require third-party assessments and more rigorous levels of cyber security hygiene. Even the DoD itself failed to measure up to the tough requirements outlined in the program.

    The CMMC assessment industry has also been booming since the program was implemented and this news will leave many of those outfits in limbo, DoD contractors were using the C3PAO assessment to be officially CMMC certified and for CMMC audits. CMMC C3PAO assessors have received specialized training to be authorized to conduct CMMC assessments and guide organizations through their CMMC journey.

    CMMC shares overlap with NIST 800-171 compliance (NIST is also the inspiration for many other cybersecurity frameworks such as CIS) and while the third-party audit portion may be paused at the moment, we still recommend businesses strive to meet compliance with their chosen cyber security framework just as a matter of good practice.

    Cyber security framework compliance helps your business:

    1. Reduces the chance of a successful cyberattack
      A framework like the NIST Cybersecurity Framework helps a business identify weak passwords, missing updates, excessive permissions, unsecured devices, and other common gaps before attackers exploit them.
    2. Limits damage when an incident occurs
      Clear access controls, network protections, backups, endpoint security, and incident-response procedures can keep a compromised account or computer from turning into a business-wide disaster.
    3. Improves detection and response time
      Logging, monitoring, alerting, and documented escalation procedures help the business recognize suspicious activity sooner and respond consistently instead of improvising during a crisis.
    4. Protects business operations and customer data
      The framework encourages reliable backups, recovery testing, data classification, vendor oversight, and continuity planning. These controls help the company continue operating after ransomware, equipment failure, or account compromise.
    5. Builds trust and supports compliance requirements
      Following a recognized framework demonstrates that cybersecurity is being managed systematically. This can help with cyber-insurance applications, customer security questionnaires, contractual requirements, audits, and regulated-data obligations.

    As a managed service provider, we help our clients meet compliance requirements for NIST, CMMC, CIS, HIPAA, WISP and more. It can be difficult for a small or medium-sized business to tackle and maintain the security features implemented alone, we suggest working with a trusted partner in this process.

    For CMMC contractors, at this point it is too early to know what will happen in the future or with the program in general but the protections that have been put in place to meet the requirements are still a net positive for your business’s security posture. If scaling up your business’s security goals and addressing compliance requirements is on your radar for 2026, Valley Techlogic can be your trusted partner in the process. Learn more today through a consultation.

    This article was powered by Valley Techlogic, leading provider of trouble free IT services for businesses in California including Merced, Fresno, Stockton & More. You can find more information at https://www.valleytechlogic.com/ or on Facebook at https://www.facebook.com/valleytechlogic/ . Follow us on X at https://x.com/valleytechlogic

  • We all know MFA is important, but many users are expressing symptoms of “MFA fatigue”

    We all know MFA is important, but many users are expressing symptoms of “MFA fatigue”

    Multi-factor authentication, commonly called MFA, has become one of the most important protections a business can put in place. It helps stop attackers from getting into company accounts even when a password has been stolen, guessed, reused, or leaked in a breach. However, there is a real problem many businesses are running into: people are tired of MFA prompts.

    Employees are juggling email, Teams, payroll systems, accounting tools, CRMs, file sharing platforms, vendor portals, and remote access systems. When every app seems to ask for another code, another approval, or another phone notification, MFA can start to feel like a daily annoyance instead of an important security control.

    That frustration is understandable. But turning MFA off, weakening it, or only applying it to a few users is not the answer. The right answer is to build an MFA strategy that protects the business without making employees miserable. Passwords are no longer enough to protect business accounts. NIST notes that MFA adds protection by requiring more than just a username and password, using a combination of something you know, something you have, or something you are.

    For a small business, one compromised account can create a chain reaction. If an attacker gets into email, they may be able to reset passwords for other services, read invoices, impersonate executives, redirect payments, access sensitive files, or launch phishing attacks against clients and vendors. That is why MFA matters so much. It creates a second barrier between a stolen password and your business data.

    The problem is that not all MFA is equally strong. Microsoft has warned that traditional MFA methods like SMS codes, email one-time passcodes, and basic push notifications are becoming less effective against modern attackers, especially when attackers use phishing, social engineering, or MFA bombing to wear users down. In other words, the goal should not simply be “turn on MFA.” The goal should be to use the right kind of MFA in the right places.

    First let’s identify what we mean by “MFA fatigue”, MFA fatigue can mean two different things. first is normal user frustration. Employees get annoyed when they are prompted too often, especially if prompts feel random, repetitive, or disruptive.

    The second is an actual attack technique. In an MFA fatigue or “push bombing” attack, a criminal already has the user’s password and repeatedly sends MFA approval prompts, hoping the user eventually taps “approve” just to make the noise stop. Microsoft specifically identifies user fatigue and MFA bombing as ways attackers bypass weaker authentication methods. This is why businesses need to treat MFA fatigue seriously. It is both a usability issue and a security issue.

    Some businesses technically have MFA enabled, but only in a limited or inconsistent way. That can create a false sense of security. Common issues include:

    • MFA is required for some employees but not all.
    • Admin accounts are not protected with stronger authentication.
    • Email-based MFA is used as the primary method.
    • SMS codes are allowed for sensitive accounts.
    • Employees receive push prompts without number matching or location context.
    • Legacy authentication methods are still allowed.
    • Former employees, contractors, or shared accounts are not reviewed.
    • MFA recovery processes are informal or undocumented.

    These gaps matter, attackers usually do not need access to every account. They only need access to one useful account. A compromised mailbox can lead to business email compromise, fraudulent payment requests, client impersonation, data theft, or ransomware. For businesses that work with regulated data, financial information, legal documents, healthcare information, or client confidential records, the risk is even higher.

    A good MFA strategy should be strong, simple, and consistent. It should protect the business while reducing unnecessary friction for users. First, require MFA for every user. MFA should not be limited to owners, managers, or employees who “handle sensitive information.” In a modern cloud environment, almost every account has some level of business risk.

    Second, prioritize stronger authentication methods. App-based MFA is better than SMS or email-based verification, but phishing-resistant methods are better still. Microsoft describes passkeys as phishing-resistant credentials that can serve as an MFA method, and notes that they can reduce prompts while improving security.

    For most small businesses, a practical MFA roll out path looks like this:

    1. Eliminate email-based MFA wherever possible.
    2. Move users to an authenticator app with number matching.
    3. Use passkeys or security keys for administrators, finance users, executives, and anyone with access to sensitive systems.
    4. Keep SMS only as a temporary fallback, not the preferred method.
    5. Document account recovery so users are not locked out when phones are replaced or lost.

    Microsoft also notes that number matching is critical to reducing accidental MFA approvals, especially as MFA fatigue attacks increase. The best MFA setup is not the one that prompts users constantly. The best setup is the one that prompts users when it actually matters.

    Small businesses can reduce MFA fatigue by using smarter access policies. For example, users may not need to be prompted every single time they access a trusted app from a managed device in a normal location. But they should absolutely be challenged when signing in from a new device, an unusual location, a risky session, or a sensitive admin portal. This is where conditional access policies can help. Instead of treating every login the same, conditional access allows the business to apply stronger controls based on risk.

    A good policy may consider:

    • Who the user is
    • What app they are accessing
    • Whether the device is trusted
    • Whether the sign-in location is expected
    • Whether the account has administrative privileges
    • Whether the session appears risky

    This gives employees a smoother daily experience while still applying stronger controls when the risk is higher. MFA is not just a technical setting. Employees need to understand what to do when they receive a prompt. The rule should be simple: never approve an MFA prompt you did not initiate.

    If an employee receives an unexpected MFA prompt, that may mean someone already has their password. They should deny the request and report it immediately. Users should not ignore it, approve it, or assume it is a glitch. Training does not need to be complicated. A short, clear explanation is usually enough:

    “MFA prompts should only appear when you are actively signing in. If you get a prompt you did not request, deny it and contact IT.” That one rule can stop a serious  incident.

    Also, Administrative accounts deserve extra protection. These accounts can often change security settings, reset passwords, access sensitive data, create new users, modify mail flow, and approve applications. For admin accounts, stronger MFA should be required. Passkeys, FIDO2 security keys, or other phishing-resistant methods are strongly preferred. NIST also recommends phishing-resistant authentication for sensitive applications and users with elevated privileges. Business owners, finance users, HR users, and anyone who can approve payments or access confidential client data should also be considered high-risk.

    Special consideration should also be taken when addressing new employees. MFA should be built into onboarding, role changes, and offboarding. When a new employee starts, they should be enrolled in the correct MFA method from day one. When someone changes roles, their access and authentication requirements should be reviewed. When someone leaves the company, their sessions should be revoked, their account should be disabled, and their access should be removed promptly.

    This is especially important for small businesses because responsibilities often overlap. One person may handle finance, HR, operations, and vendor relationships. That makes account security even more important.

    The bottom line is MFA fatigue is real. Employees are tired of excessive prompts, confusing login flows, and security tools that get in the way of work, but avoiding MFA is not a realistic option. The risk of account compromise, payment fraud, data theft, and business disruption is too high. The better approach is to modernize MFA. Require it consistently, move away from weaker methods, use phishing-resistant authentication where possible, reduce unnecessary prompts, and train users to recognize suspicious activity.

    Security should not feel like punishment. Done correctly, MFA can become a normal, low-friction part of doing business safely. If your business is still relying on passwords alone, email-based MFA, SMS codes, or inconsistent MFA policies, now is the time to review your setup. Valley Techlogic can help evaluate your current Microsoft 365 and cloud security configuration, identify gaps, and build an MFA strategy that protects your business without overwhelming your users. Learn more today with a consultation.

    This article was powered by Valley Techlogic, leading provider of trouble free IT services for businesses in California including Merced, Fresno, Stockton & More. You can find more information at https://www.valleytechlogic.com/ or on Facebook at https://www.facebook.com/valleytechlogic/ . Follow us on X at https://x.com/valleytechlogic

  • Are you keeping track of breaches that are happening with your vendors? What small businesses can learn from the Klue/Salesforce breach

    Are you keeping track of breaches that are happening with your vendors? What small businesses can learn from the Klue/Salesforce breach

    When most small businesses think about cybersecurity, they think about their own systems first. Are our computers protected? Are our passwords strong? Is our email secure? Do we have backups?

    Those are all important questions. But there is another question that deserves just as much attention: Are the vendors we rely on putting our business data at risk?

    The recent Klue/Salesforce breach is a good reminder that small businesses do not operate in a vacuum. Even if your own network is locked down, your data may still live in someone else’s system. It may be stored in your CRM, marketing platform, accounting software, ticketing system, quoting tool, password manager, payroll provider, or any number of cloud applications connected to each other behind the scenes.

    In this case, public reporting indicates that attackers abused access tied to Klue, a competitive intelligence platform, to reach data connected through Salesforce environments. The important lesson is not just “Salesforce” or “Klue.” The bigger lesson is that connected vendor platforms can become pathways into sensitive business data.

    For small businesses, that matters a lot.

    You may not have a full-time security team watching every vendor announcement. You may not have a compliance department tracking every software integration. But you probably do have customer information, employee information, invoices, quotes, sales notes, passwords, emails, support tickets, or financial records spread across multiple vendors.

    That means vendor breach monitoring needs to be part of your normal security routine. A vendor breach does not have to involve your internal server, your firewall, or your employee laptops to affect you.

    If a third-party platform you use is compromised, attackers may be able to access customer records, support cases, contact lists, documents, billing details, or internal notes. Even when passwords are not exposed, stolen business data can still be used for phishing, impersonation, fraud, social engineering, or targeted scams.

    This is especially dangerous because vendor-related phishing can look very believable. If an attacker knows who your customers are, what services they use, who manages their account, or what projects are active, they can write emails that sound legitimate.

    For a small business, the damage can be immediate. Customers lose trust. Staff waste time investigating. Leadership has to figure out whether notifications are required. And if nobody was watching for the breach in the first place, the business may learn about it too late.

    Three steps small businesses can take to monitor vendor breaches

    1. Keep a simple vendor and data inventory

    You cannot monitor vendor risk if you do not know which vendors have access to your data.

    Start with a simple spreadsheet or shared document. It does not need to be complicated. List every cloud service your business uses, what kind of data it stores, who owns the relationship internally, whether it connects to other systems, and how critical it is to your operations.

    At minimum, track:

    • Vendor name
    • Type of data stored
    • Admin owner
    • Login method
    • Connected integrations
    • Business impact if breached

    Pay special attention to tools connected to email, CRM, file storage, accounting, remote access, security, payroll, and customer support. These systems tend to hold valuable data or provide access to other platforms.

    The goal is simple: if a breach happens, you should be able to quickly answer, “Do we use this vendor, what data is there, and what should we check first?”

    1. Subscribe to vendor security notices and monitor trusted sources

    Many small businesses only hear about vendor breaches from social media, a random news article, or a customer asking whether they are affected. That is not good enough. For your most important vendors, subscribe to their security advisories, status pages, email alerts, and trust center updates. If they offer a security notification list, use it. If they have a status page, bookmark it. If your vendor has an admin portal with security notices, make sure someone checks it.

    You should also monitor reliable cybersecurity news sources and breach notification feeds for vendors you depend on. This does not mean doom-scrolling every day. It means assigning someone to keep a light but consistent eye on the tools that matter most to the business.

    For managed IT clients, this is also an area where your IT provider can help. Vendor breach monitoring should not be treated as an occasional panic response. It should be part of normal operational security.

    1. Have a vendor breach response checklist before something happens

    When a vendor breach hits the news, the worst time to build your response process is after the fact. Small businesses should have a short checklist ready. When a vendor announces a breach, your team should know how to assess whether you are affected and what actions to take.

    A practical checklist should include:

    • Confirm whether your business uses the vendor or affected integration
    • Review what data the vendor stores or can access
    • Check vendor advisories for affected dates, systems, and data types
    • Revoke or rotate API keys, OAuth tokens, passwords, and connected app permissions where appropriate
    • Review admin accounts and recent login activity
    • Look for suspicious email, CRM, file, or support activity
    • Warn staff about phishing attempts tied to the incident
    • Determine whether customers, employees, insurers, legal counsel, or regulators need to be notified
    • Document what was reviewed and what actions were taken

    We have a simple template for this you can grab below that also covers breaches within your business:

    This does not need to be a 40-page incident response plan. It just needs to be clear enough that your team can act quickly and calmly. The big takeaway is that security does not stop at your own front door.

    Modern businesses are built on connected cloud platforms. That brings huge benefits, but it also creates shared risk. A vendor integration, API token, or connected app can become a weak link, even when your own systems are not directly compromised. Small businesses should not respond by abandoning cloud tools, that’s not realistic. The better response is to know which vendors matter, track where your data lives, monitor for breach notices, and have a plan for what to do when something goes wrong. You do not need enterprise-level complexity to do this well. You need consistency, ownership, and a clear process.

    Vendor breaches are no longer rare edge cases. They are part of doing business in a cloud-connected world. The businesses that handle them best are not the ones that never use vendors. They are the ones that know their vendors, monitor their risk, and respond quickly when the situation calls for it. At Valley Techlogic, we act as a vendor liaison for clients and can help you monitor and respond to breaches even if they’re not happening to your organization directly. Learn more today through a consultation.

    This article was powered by Valley Techlogic, leading provider of trouble free IT services for businesses in California including Merced, Fresno, Stockton & More. You can find more information at https://www.valleytechlogic.com/ or on Facebook at https://www.facebook.com/valleytechlogic/ . Follow us on X at https://x.com/valleytechlogic

  • Addressing legacy tech debt, 5 strategic ways to clean up your office and remove covert cyber security threats hidden in plain sight

    Addressing legacy tech debt, 5 strategic ways to clean up your office and remove covert cyber security threats hidden in plain sight

    Old technology has a way of blending into the background. A forgotten desktop under a desk, an unused printer in a storage closet, a retired router still plugged into the network, or a pile of mystery cables in the server room may not seem urgent. But legacy hardware can quietly become one of the most overlooked cyber security risks inside a business.

    For many small and mid-sized businesses, tech debt is not just outdated software or inefficient systems. It is also the physical technology that remains in the office long after it should have been removed, replaced, documented, or securely disposed of. These devices can create hidden vulnerabilities, consume unnecessary power, complicate troubleshooting, and increase the chance of data exposure.

    The problem is that old hardware often looks harmless. A dusty workstation may still contain sensitive files. A retired firewall may still have saved configuration data. An unused printer may store scanned documents, address books, or authentication details. Even abandoned network equipment can create confusion during audits, upgrades, or incident response.

    Cleaning up legacy hardware is not just an office organization project. It is a practical cyber security initiative. Every device connected to your business environment has a lifecycle. It is purchased, configured, used, maintained, replaced, and eventually retired. The risk appears when that final step never happens properly.

    Hardware that is no longer actively managed may stop receiving firmware updates. Devices may remain connected to the network without anyone realizing it. Old computers may sit in closets with cached credentials, local files, browser passwords, or copies of client data. Drives may be removed and stored without encryption. Equipment may be passed between employees without proper wiping or documentation.

    This creates a messy environment where nobody is completely sure what exists, what is still in use, what contains data, or what could be exploited.

    Here are 5 strategic ways to clean up legacy technology

    • Create a complete hardware inventory. Start by documenting every physical device in the office, including desktops, laptops, monitors, printers, scanners, servers, network switches, routers, firewalls, access points, external drives, phones, and conference room equipment. Record the device name, serial number, location, assigned user, age, warranty status, and whether it is still actively used.
    • Identify anything that is no longer supported or no longer needed. Old hardware should be reviewed against current business needs and vendor support timelines. Devices that no longer receive firmware updates, cannot run supported operating systems, or are no longer assigned to a real business function should be flagged for replacement, removal, or secure disposal.
    • Disconnect unknown or unmanaged devices from the network. If a device cannot be identified, managed, updated, or tied to a business purpose, it should not remain connected. This includes old switches, forgotten wireless access points, retired desktops, unused printers, and any device that nobody can confidently explain. Unknown hardware creates unnecessary risk and makes your environment harder to secure.
    • Securely wipe or destroy storage media before disposal. Computers, servers, external drives, copier hard drives, and even some printers may retain sensitive business data. Before anything leaves the office, storage media should be properly wiped, encrypted, or physically destroyed according to your data handling requirements. Simply deleting files or performing a basic reset is not enough for many devices.
    • Build a formal retirement process for future hardware. Cleanup should not be a one-time event. Create a standard process for retiring equipment that includes documentation, backup confirmation, data wiping, license removal, asset tag updates, and approved recycling or disposal. A simple repeatable process prevents old hardware from piling up again.

    A cleaner technology environment is easier to manage, easier to secure, and easier to support. When your business knows exactly what hardware exists and why it exists, you reduce uncertainty. That matters during cyber security reviews, insurance questionnaires, vendor audits, compliance checks, and real-world incident response.

    It also improves day-to-day operations. Technicians spend less time tracing mystery cables, identifying unknown devices, or troubleshooting equipment that should have been retired years ago. Employees benefit from more reliable systems, fewer workarounds, and a more organized workspace.

    Just as importantly, removing old hardware reduces the number of places where sensitive data can hide. Every forgotten device is a potential storage location, access point, or weak link. Cleaning it up gives your business better control over its information and its risk.

    So how can a Managed Service Provider (like Valley Techlogic) help? Your MSP can play a key role in turning hardware cleanup into a structured cyber security improvement rather than a messy office project. An MSP can help inventory devices, identify unsupported hardware, review network-connected equipment, recommend replacements, securely wipe retired systems, document asset status, and coordinate proper disposal or recycling. They can also help build a repeatable lifecycle process so future hardware does not become tomorrow’s hidden tech debt.

    Legacy tech debt is not always digital.Businesses often think about cyber security in terms of passwords, email threats, antivirus software, and cloud security. Those things matter, but physical technology matters too.

    Legacy hardware should not be ignored just because it is quiet. If it is still in your office, still storing data, or still connected to your network, it deserves attention. If you need assistance in auditing and cleaning up your business’s tech environment (including decommissioning old hardware or doing an audit of your software stack) reach out to us today to schedule a free walkthrough and evaluation.

    Looking for more to read?

    This article was powered by Valley Techlogic, leading provider of trouble free IT services for businesses in California including Merced, Fresno, Stockton & More. You can find more information at https://www.valleytechlogic.com/ or on Facebook at https://www.facebook.com/valleytechlogic/ . Follow us on X at https://x.com/valleytechlogic

  • AI is making fraud easier and more lucrative, with AI enabled phishing emails seeing 25% higher open rates than human crafted variations

    AI is making fraud easier and more lucrative, with AI enabled phishing emails seeing 25% higher open rates than human crafted variations

    Artificial intelligence has changed the economics of fraud. Scammers no longer need to be skilled writers, native speakers, designers, or even patient researchers to create believable attacks. With AI tools, they can generate polished emails, mimic trusted business language, personalize messages using public information, and test different versions of a scam at scale. We are even seeing instances where scam calls are being placed using AI voice modifications are tricking users into believing the call is regional (often with a spoofed number to really send it home). In a nutshell, scams are getting much more sophisticated and AI is helping bad actors achieve more, faster.

    That matters because phishing and vishing (a portmanteau of “voice” and “phishing”) has always relied on one core weakness: trust. When an email looks familiar, sounds professional, and appears to come from a person or company you recognize, it becomes much easier to click before thinking or hand over information you would never think to provide otherwise. AI makes that easier for attackers and more dangerous for everyone else.

    A representative from Kaseya recently shared with us that AI enabled phishing emails are seeing 25% higher open rates than human crafted variations. While results can vary by campaign, audience, and security training maturity, the takeaway is clear: AI is making phishing more convincing, more scalable, and more profitable for criminals.

    Traditional phishing emails were often easier to spot. They contained awkward wording, strange formatting, vague requests, or obvious spelling mistakes. AI has removed many of those warning signs.

    Today’s phishing emails may reference your company, your vendors, your industry, recent business activity, or a real person inside your organization. They can be short and casual, formal and executive-sounding, or written in the exact tone of a normal business request.

    Even worse, criminals can now generate hundreds of variations quickly. If one version does not work, they can adjust the subject line, tone, timing, sender name, or call to action until something lands. Here are some common variations of phishing scams we’re now seeing as a technology service provider:

    • The message creates urgency, such as “today only,” “final notice,” “immediate action required,” or “payment must be processed now.”

    • The sender asks you to bypass normal processes, especially for payments, password resets, MFA approvals, bank changes, or file access.

    • The email sounds polished but slightly off, especially if the request does not match the sender’s usual behavior.

    • The message includes a link to a login page, shared document, voicemail, invoice, shipping notice, or payment portal you were not expecting.

    • The sender pressures you not to call, not to verify, or not to involve anyone else.

    • The request involves gift cards, wire transfers, ACH changes, cryptocurrency, payroll updates, or sensitive business data.

    We also want to note,accounts payable teams are especially vulnerable because their work already involves invoices, payment requests, vendor communication, banking details, and deadlines. AI gives scammers better tools to blend into that workflow.

    A fake invoice used to be relatively basic. Now, an attacker can create a professional-looking invoice with realistic branding, matching language, convincing line items, and payment instructions that appear normal at first glance. In more advanced cases, criminals may combine fake invoices with compromised email accounts, vendor impersonation, cloned voices, or deepfake video messages that appear to come from an executive, vendor, or finance leader.

    This is where deepfake invoice fraud becomes especially dangerous. The invoice itself may look real, but the larger scam may include an AI-generated voicemail, a realistic video message, or a spoofed email thread that appears to confirm the payment. The goal is simple: make the request feel legitimate enough that accounts payable processes it before anyone verifies the change.

    Here’s how to avoid falling victim:

    • Verify payment changes through a trusted channel. Do not use the phone number or email address included in the suspicious message. Use a known contact from your records.

    • Require secondary approval for new vendors, bank account changes, large payments, urgent wires, and unusual invoice requests.

    • Slow down when a message creates pressure. Urgency is one of the strongest signs that someone is trying to push you into a mistake.

    • Check sender addresses carefully. Look for lookalike domains, extra letters, changed display names, and replies that come from unexpected addresses.

    • Do not approve MFA prompts you did not initiate. Attackers often combine phishing with login attempts and push notification fatigue.

    • Hover over links before clicking, and avoid logging in through links in unexpected emails. Go directly to the known website instead.

    • Train employees with realistic phishing examples, including AI generated messages that look polished and professional.

    • Use modern email security, MFA, endpoint protection, DNS filtering, and identity monitoring to reduce the chances that one bad click turns into a major incident.

    • Build a culture where employees are praised for verifying suspicious requests. People should never feel embarrassed for slowing down a payment or asking for confirmation.

    The bottom line is that AI does not create entirely new fraud. It makes old fraud faster, cheaper, more convincing, and easier to scale. That is why businesses need to stop treating phishing as a problem that only happens to careless people.

    The strongest protection is a combination of technology, training, and processes. Email filtering helps, MFA helps, endpoint protection helps, but for payment fraud, business email compromise, and fake invoice scams, process matters just as much. A quick phone call directly to a known number for the person/company, a second approval, or a strict vendor change procedure can be the difference between catching a scam and wiring money to a criminal.

    Fraud is getting more convincing. Your defenses need to become more deliberate. At Valley Techlogic we are continuously working on future proofing our customers against scams and intrusions, and all of our plans come with cybersecurity built in. Learn more today with a consultation.

    Looking for more to read?

    This article was powered by Valley Techlogic, leading provider of trouble free IT services for businesses in California including Merced, Fresno, Stockton & More. You can find more information at https://www.valleytechlogic.com/ or on Facebook at https://www.facebook.com/valleytechlogic/ . Follow us on X at https://x.com/valleytechlogic and LinkedIn at https://www.linkedin.com/company/valley-techlogic-inc/.

  • Education platform Canvas reached settlement with ransomware group “ShinyHunters” to prevent the release of data affecting 275 million users

    Education platform Canvas reached settlement with ransomware group “ShinyHunters” to prevent the release of data affecting 275 million users

    At the worst possible time, millions of students and educators found themselves locked out of Canvas, the digital backbone of classrooms across the country. What started as a cybersecurity incident quietly detected in late April 2026 exploded into one of the largest educational data breaches on record, hitting right as schools entered finals season.

    Canvas is a cloud-based learning management system (LMS) operated by a company called Instructure. It is a digital hub where teachers post assignments, students submit work, grades are recorded, and classroom communication happens. Its reach is enormous. Canvas counts more than 30 million active users globally and serves over 8,000 institutions as customers. In North America alone, it is used by 41% of higher education institutions, alongside thousands of K-12 schools. When it goes down, millions of people feel it immediately.

    The incident did not appear out of nowhere. Instructure first detected unauthorized activity on April 29, 2026, and began an internal investigation. For a few days, the situation seemed contained. Then, on May 7, everything changed.

    Students logging into Canvas around 1�20 p.m. PDT found something unexpected on their dashboards: a ransom note. The message was signed by ShinyHunters, a well-known criminal hacking group, and it was blunt. It claimed the group had breached Instructure, accused the company of ignoring earlier contact attempts, and threatened to release all stolen data unless affected schools negotiated a ransom settlement through the encrypted messaging platform Tox by the end of May 12, 2026.

    “Instead of contacting us to resolve it, they ignored us and did some ‘security patches,’” the group wrote on user dashboards.

    Instructure took Canvas offline shortly after to contain the damage. The outage disrupted access during a critical period, leaving students and faculty at thousands of colleges and K-12 schools scrambling for course materials, assignments, and communications.

    ShinyHunters claimed to have stolen 3.65 terabytes of data tied to approximately 275 million users across roughly 9,000 institutions worldwide. The list of affected schools included major universities like Columbia, Princeton, Harvard, and Georgetown, as well as large public school systems across the country.

    The breach is considered the largest educational security incident on record by scope and scale. According to Instructure’s own investigation, the stolen data included:

    • Names, email addresses, and student ID numbers

    • Private messages exchanged between students and teachers

    Instructure stated it found no evidence that passwords, dates of birth, government identification numbers, or financial information were compromised. That is meaningful, but the exposure of private messages and identifying information is still significant, particularly given how personally sensitive communications between students and educators can be.

    Instructure issued an apology on May 11 and updated its status page to note that Canvas was back online with no indication of ongoing unauthorized activity. On May 12, the company announced that the stolen data had been “returned” following an agreement with the hackers.

    Cybersecurity experts were quick to note that “returned” data does not mean deleted data. There is no reliable way to confirm that copies were not made or retained before any handover.

    Instructure notified impacted organizations on May 5 and has advised that affected schools will be contacted directly. For students, parents, and staff, the school or institution itself is the recommended first point of contact. The company is also organizing a leadership webinar to share further details about the attack and steps taken to harden its systems.


    If you use Canvas through a school or university, take these steps:

    • Enable Multifactor Authentication (MFA) on your Canvas account and any other school platform that offers it. This single step dramatically reduces the risk of unauthorized access even if your credentials were exposed.

    •  Be skeptical of unexpected emails or messages referencing your Canvas account, your school, or this breach. Phishing attempts often follow major incidents and can be convincingly detailed when attackers already have your name and email address.

    Schools and IT administrators should rotate Canvas integrations, API keys, and single sign- on connectors, and review authentication logs for unusual activity between April 25 and May 8, 2026, per guidance from both Instructure and the Federal Student Aid office.

    The Canvas breach is a reminder that education technology has become critical infrastructure, and critical infrastructure is a target. When a single platform serves 41% of North American higher education, a single point of failure becomes a national-scale event. The timing compounded the damage. Finals week is the highest-stakes period of the academic calendar. For students preparing for exams, submitting final papers, or trying to reach professors, even a few hours of outage created real consequences.

    The breach raises important questions about how much sensitive communication is flowing through third-party platforms, and what obligations companies like Instructure have to protect it. Private messages between students and teachers were never meant for anyone else. That data is now out in the world in some form, regardless of what “returned” officially means. Stay alert, update your account security, and watch for follow-up communications from your school’s IT department.

    Valley Techlogic plans include cyber security support and prevention, and we have worked with those in educational space to create customized solutions that take student safety in mind (including content filtering, strategies to protect student data privacy, device security and more). Learn more about our security as a service solutions here.

    Looking for more to read?

    This article was powered by Valley Techlogic, leading provider of trouble free IT services for businesses in California including Merced, Fresno, Stockton & More. You can find more information at https://www.valleytechlogic.com/ or on Facebook at https://www.facebook.com/valleytechlogic/ . Follow us on X at https://x.com/valleytechlogic and LinkedIn at https://www.linkedin.com/company/valley-techlogic-inc/.