Other people's courses appearing in Review?

It seems like the issue was present from around 9am ET yesterday until a change was reverted around 730pm ET yesterday.

It seems to happen on publish (as in shortly after publishing it was showing up on the wrong users homepage for a split second) 

Officially I'm annoyed they haven't given much guidance, but unofficially I'd say if you published any courses during that time period I would delete the publish and republish as an entirely new version (Not new version of existing course because that keeps the same URL) because once someone has the URL they'd retain access until the course is deleted. (I'd download the comments first so you don't lose them, if applicable)

I also suggested to articulate that they change all the URLs on their end (as this way we wouldn't lose all the comments) but I personally can't risk waiting for them to do that.

I'm really upset that when they were notified they didn't *immediately* shut down review 360, it's too big a breach for them to have taken THREE HOURS to act. 

Bad enough that it took 5-6 hours before they were even notified to begin with, but that's outside their control.

Their reaction when they WERE notified is unacceptable. With a breach that serious they should be proactive not reactive in their response. 

Thanks for getting in touch with us about yesterday’s Review 360 incident. I’d like to provide more context about what happened and what we’re doing about it. 

Yesterday at 1:47 pm ET, our team published an update to Review 360 that made it possible for a small number of Review 360 users to see content created by users outside their account. 

Customers alerted us about this issue yesterday at 4:53 pm ET, and our team began investigating immediately. We identified the cause and reverted the update at 7:31 pm ET. Since then, our team has been focused on gathering details to share with any users affected by this issue to make sure we’re communicating with folks as soon as possible.  

We’re reaching out to customers who were directly affected by this issue. 

More information is available on our status page: https://www.articulatestatus.com and a full post mortem is available here.

We're working on identifying exactly where our engineering and quality processes broke down here so we can make sure it doesn't happen again. We know we hold an important obligation to safeguard your content and maintain your trust, and we are deeply sorry. We’ll work hard to earn your trust with improved processes. 

If you have any other questions, please reach out to our Support Team directly by emailing Support@articulate.com or opening a Support case.

The impact of this breach depends on what Articulate customers viewed our content. We need to manage the impact which means we need to know who saw our content. Is this possible? 

Any update on a definitive fix? Would be a shame to happen again.

Since last week’s post-mortem, we’ve dug further into this incident and identified the exact circumstances in which folks could view content that they weren’t authorized to see. We’d like to share this context. 

Right now, the Review 360 engineering team is working on developing a team folders feature. This functionality will allow members of the same Articulate 360 team to organize content into folders that are shared with their teammates. 

To build this feature, the team created a process where users’ dashboards receive updates when teammates create new shared content. Last week, the team released a bug where users could receive updates that were not correctly filtered to members of their team. This bug only occurred in a very specific set of circumstances: when a user navigated from viewing Review 360 content back to the dashboard and while the dashboard was still loading.

This error was limited to displaying the content in the user’s dashboard and enabling the user to view the content. The user wouldn’t be able to duplicate, download, export, rename, or move content. 

What’s Next

We’re working through our process for investigating serious incidents, and that means we’ve appointed an internal incident investigator from outside the responsible engineering team. This investigator will interview team members, review code and internal processes, and ultimately make recommendations to address the gaps that this incident exposed. We’ll update you further with an overview of the types of changes we’re making to ensure this doesn’t happen again. 

Please let us know if you have any questions or if we can provide additional context for your team.

This just happened to me again. I uploaded a video to Review and immediately saw a comment from someone who attached an image from another company's eLearning course. My colleague also saw some courses appear from Amazon. I guess that's why Review 360 just went offline. Someone needs to look at this ASAP.

Hi there, Art.

I'm sorry to hear you're seeing other peoples comments in Review 360. We're currently experiencing an outage that partially affects Review 360. You can stay up to date on our progress and subscribe for updates on our status page:

• Articulate Status

I'll also jump back in here when a fix is in place!

Thanks for reaching out!

Good news, Art!

Review 360 is back up and running. Simply refresh your course to Review 360 and you should be good to go!