The recent Canvas hack has sparked a debate about whether paying ransoms to hackers is a viable strategy. Instructure, the US tech firm behind the education platform Canvas, faced a ransomware attack that led to the theft of data from hundreds of millions of students worldwide. The hackers, ShinyHunters, threatened to release the data unless a ransom was paid. The company eventually reached an agreement with the hackers, and while the details remain murky, experts interpret this as a ransom payment. This incident highlights the complex dilemma faced by companies when dealing with cybercriminals. Governments worldwide advise against paying ransoms, citing the potential funding of further criminal activities and the lack of guarantee that it will prevent data release. However, many companies still opt to pay, as evidenced by the 75 businesses with turnovers of at least $3 million per year that had paid ransoms as of January 2026. The average ransom paid in Australia was $711,000, down from $1.35 million the previous year. The question of whether paying ransoms is effective is a contentious one. While some argue that it can prevent further harm and data exposure, others warn that it may not be a reliable strategy. The hackers' business model relies on demonstrating honesty to potential victims, as this encourages payment. However, the reliability of such promises is questionable, as hackers may provide false evidence of data destruction. The incident with Instructure serves as a cautionary tale, emphasizing the need for companies to carefully consider their approach to ransomware attacks and the potential consequences of paying ransoms.
