Canvas hack: is it ever a good idea to pay a ransom, and what happens to the data?

Key points

• After a week of outages, hundreds of millions of students’ data stolen, delayed assignment due dates and school login pages being defaced by hackers, the US tech firm Instructure – which operates the education platform Canvas, used by education providers worldwide – announced it had “reached an agreement with the unauthorised actor” behind the ransomware attack.
• Experts read the careful language as a sign that a ransom has been paid.
• The company has not confirmed this.
• The question of whether firms should pay ransomware attackers to regain access to their systems, and potentially prevent further harm from the release of personal information of – in some cases millions – is one that thousands of companies face each year.
• Although governments across the globe advise against it, many ultimately do.