The Growing Debate Around Ransomware Payments
A recent cyber incident about Canvas hack has reignited a difficult question for organisations facing ransomware attacks: should companies pay hackers to prevent stolen data from being released?
The company responsible for the widely used Canvas learning platform has confirmed it reached a settlement with the threat actors behind last week’s cyber attack, which caused significant disruption for thousands of universities and colleges worldwide.
The incident affected around 9,000 educational institutions across the UK, US, Canada, and Australia, with some exams and academic activities impacted when Canvas services became unavailable.
According to reports, the attackers claimed to have stolen approximately 3.5 terabytes of data belonging to students and educational institutions and threatened to release it publicly.
The developer of Canvas, Instructure Inc has since stated that an agreement was reached with the attackers. The group has reportedly deleted the stolen information and committed not to target students or institutions with further extortion attempts.
However, cybersecurity and law enforcement agencies generally advise against making payments to cybercriminals, as doing so can encourage future attacks and provides no independent assurance that compromised data has actually been destroyed.
Paying cybercriminals is never a guarantee
Even when a ransom is paid:
- There is no certainty that stolen data has been deleted.
- Attackers may still retain copies of the information.
- Organisations can become targets for future extortion attempts.
- Payments could help fund further criminal activity.
This highlights an important reality of modern cyber threats: prevention, detection, and response planning remain critical.
Businesses should ensure they have:
- Strong security controls in place
- Regular backups
- Incident response plans
- Tested recovery procedures
- Ongoing cybersecurity awareness
When organisations are faced with ransomware demands, decisions often need to be made quickly and under significant pressure. Having a well-prepared incident response plan can help reduce both business disruption and the likelihood of being forced into difficult decisions.
Cybersecurity is not just about preventing attacks, it is about being prepared for how to respond when they happen.
If you have been impacted by this or would like to discuss this further, please contact us today.
