Anaconda drops Canny.io after vendor's security incident
Anaconda has stopped using Canny.io, a third-party tool it used to collect user feedback, after the vendor suffered a security incident. The company says its products and services remain fully operational and secure, and that early findings point to no exposure of sensitive personal or customer business data.
- Canny.io, a vendor Anaconda used to collect user feedback, experienced a security incident.
- Anaconda reviewed all connected systems and rotated all associated credentials and integrations.
- Anaconda has discontinued its use of Canny.io and says its products and services are fully operational and secure.
- Early findings suggest no sensitive personal data or sensitive customer business data is at risk.
- More complete conclusions are expected at a later date; questions go to [email protected].
What Anaconda says happened
In a notice published on its blog, Anaconda said Canny.io "recently experienced a security incident." Canny.io was a vendor the company used for soliciting user feedback about its products. Anaconda is a user of the service, and the incident originated on the vendor's side.
When Anaconda learned of the incident, it began working to determine which of its systems and customers might be affected. The post does not describe the nature of the incident at Canny.io or give a timeline of events.
Steps taken in response
According to Anaconda, it acted "out of an abundance of caution." The company reviewed all of its systems that were connected to the third-party provider. It also rotated all associated credentials and integrations, a standard measure to ensure that any keys or access tokens linked to the vendor can no longer be used.
Anaconda also confirmed that it has discontinued its use of Canny.io. The company states that all Anaconda products and services are fully operational and secure.
What data is at risk
Anaconda says its findings to date suggest that no sensitive personal data is at risk. As examples, it lists bank accounts, date of birth, social security numbers and health account information. It also says no sensitive customer business data appears to be affected.
The company describes this as an early assessment. It chose to share it now and hopes to have more complete conclusions at a later date. The wording indicates the investigation is not finished, and the findings could be updated.
What it means for customers
For Anaconda users, the notice indicates that the company's own systems were not the source of the incident and that it has taken the connected integrations out of use. Anyone with questions can contact the company at [email protected]. Anaconda says it will respond as quickly as it can.
The company stated that "security and transparency are core to the trust we build with our customers." Further details on the scope of the incident are expected only once Anaconda completes its review.
Anaconda: What We Know About a Recent Third-Party Security Incident
