On August 8, 2022, the Articulate team made a change to Review 360 that made it possible for a limited number of comments containing multiple attachments to be seen by unintended users outside of the project. Comments with no attachments or a single attachment were not impacted by this event. The content within Review 360 projects was also not impacted by this event.

What Happened

At 9:58 am ET on August 8, 2022, the Articulate team made a change to Review 360 that caused the application to incorrectly display comments with multiple attachments on the Feedback tab or when viewing a video. New comments with multiple attachments created in Review 360 were not correctly filtered to the project associated with the comment. As a result, unintended users may have seen a Review 360 comment belonging to another project in their application and been able to download the attachments on the comment. The unintended user would not have been able to navigate to the Review 360 project or perform any other action on the comment. At no time did any user have unauthorized access to a Review 360 project.

At 11:15am ET, customers alerted us to this issue. At 11:29 am ET, we began to put Review 360 into an offline maintenance mode and the service was completely unavailable by 12:26 pm ET. We reverted the changes to Review 360 and restored the service at 3:25 pm ET.

By 3:37 pm ET, we identified a small number of impacted comments and completed protection of comment attachments so that they could no longer be downloaded. 

What We’re Doing About It

We’ve audited the comments that were impacted by this incident and have reached out to each impacted commenter and project owner to answer questions and address any concerns.

Customer security and trust is a top priority and we continually work to improve our engineering and quality processes to maintain that trust. For more information on how we protect our customers, please visit https://articulate.com/trust. If you have any further questions, please create a case and our support team will follow up.