{"id":676070,"date":"2026-05-17T04:42:10","date_gmt":"2026-05-17T04:42:10","guid":{"rendered":"https:\/\/www.newsbeep.com\/au\/676070\/"},"modified":"2026-05-17T04:42:10","modified_gmt":"2026-05-17T04:42:10","slug":"canvas-hack-is-it-ever-a-good-idea-to-pay-a-ransom-and-what-happens-to-the-data-cybercrime","status":"publish","type":"post","link":"https:\/\/www.newsbeep.com\/au\/676070\/","title":{"rendered":"Canvas hack: is it ever a good idea to pay a ransom, and what happens to the data? | Cybercrime"},"content":{"rendered":"

After a week of outages, hundreds of millions of students\u2019 data stolen, delayed assignment due dates and school login pages being defaced by hackers, the US tech firm Instructure \u2013 which operates the education platform Canvas, used by education providers worldwide \u2013 announced it had \u201creached an agreement with the unauthorised actor\u201d<\/a> behind the ransomware attack.<\/p>\n

Experts read the careful language as a sign that a ransom has been paid. The company has not confirmed this.<\/p>\n

The question of whether firms should pay ransomware attackers to regain access to their systems, and potentially prevent further harm from the release of personal information of \u2013 in some cases millions \u2013 is one that thousands of companies face each year. Although governments across the globe advise against it, many ultimately do.<\/p>\n

The hacking group ShinyHunters claimed responsibility for the attack on Instructure. It had threatened to leak the reported 3.6TB<\/a> of data \u2013 comprising of student ID numbers, email addresses, names and messages from 9,000 schools and 275 million students and staff worldwide \u2013 unless the company paid the ransom.<\/p>\n

Sign up for the Breaking News Australia email<\/a><\/p>\n

In Australia, more than two dozen universities and public and private schools in several states were victims of the attack. RMIT and UTS were among those to grant extensions on assignments as frustrated students were unable to access the portal.<\/p>\n

Instructure later confirmed that the hackers had exploited a vulnerability in its Free for Teacher software that allowed them to deface login pages, such as that for the University of Texas San Antonio, to alert users to the breach.<\/p>\n

The company said this week that the data had been \u201creturned\u201d to it as part of the agreement it reached with the hackers, and also that it was shown \u201cdigital confirmation of data destruction\u201d via shred logs \u2013 a technical report that is generated by a program that processes data to be destroyed in a way that makes it no longer recoverable.<\/p>\n

\u201cWhile there is never complete certainty when dealing with cybercriminals, we believe it was important to take every step within our control to give customers additional peace of mind, to the extent possible,\u201d the company said last week.<\/p>\n

The head of cyber at cyber forensics accounting firm McGrathNicol, Darren Hopkins, says Canvas\u2019 statement was \u201cwell crafted [in a way] that doesn\u2019t necessarily admit anything but also does demonstrate that they\u2019ve got an agreement\u201d.<\/p>\n

\u201cShinyHunters is an extortion group,\u201d he says. \u201cThis is what they do. What other agreement will they come up with?\u201d<\/p>\n

An Aegis Cybersecurity expert, Luke Irwin, estimates that based on reported ransom demands of US$10m, it\u2019s possible Instructure \u2013 or its insurance underwriter \u2013 paid somewhere up to that amount but he says it\u2019s also possible it was negotiated down.<\/p>\n

\u201cInstructure is dealing with a criminal organisation, and you are taking them at their word that they will commit to those outcomes,\u201d he says. \u201cThat is a risk-driven position Instructure needs to work within.\u201d<\/p>\n

To pay or not to pay?<\/p>\n

Most governments advise against paying ransoms, including in the UK, the US and Australia but outright bans are rare, the tech firm Akamai says in its 2025 ransomware state of the industry report.<\/p>\n

\u201cIf ransoms are not paid, then the effectiveness of the attack vector is reduced and potentially becomes less attractive to hacker groups,\u201d the report says.<\/p>\n

In Australia, it could be a criminal offence to pay an attacker that is designated under the autonomous cyber sanctions law. The sanctions office says it will consider any payment made \u201con a case-by-case basis\u201d as to whether it is referred for a prosecution.<\/p>\n

Payments could fund other criminal activities and ultimately there is no guarantee that paying a ransom or extortion would prevent the release of data or end the threats, Akamai says.<\/p>\n

Under Australia\u2019s mandatory reporting obligations that came into effect at the end of May last year, 75 businesses with turnovers of at least $3m a year had paid ransoms<\/a> as of the end of January 2026.<\/p>\n

The government does not disclose how much was paid. A McGrathNichol ransomware report from November surveyed 800 executives from Australian businesses with 50 or more employees and found the average amount paid in Australia was $711,000, down from $1.35m the year before.<\/p>\n

The report found 64% had decided to pay a ransom and 81% of businesses said they would hypothetically be willing to pay a ransom.<\/p>\n

Hopkins says businesses are getting better at preparing for a cyber-attack, meaning they are less likely to need to pay to get hackers to unlock the locked systems. Instead, businesses were more focused on trying to stop further harm by paying the hackers releasing the data.<\/p>\n

\u201cCanvas was interesting because we all suspected [Instructure] engaged with the threat actor very quickly because they were on the leak site and [the posting] got removed from it.\u201d<\/p>\n

\u2018How honest is that criminal?\u2019<\/p>\n

The question Hopkins gets asked in boardrooms across Australia, when training businesses on cyber-attacks, is: Will making a payment stop data being exposed?<\/p>\n

\u201cThat question around \u2018how honest is that criminal?\u2019 comes up all the time,\u201d he says.<\/p>\n

\u201cThe business model [of hackers] needs them to show that they\u2019re honest because no one would ever pay them. So it\u2019s a big trust factor.\u201d<\/p>\n

Irwin says it is in ShinyHunters\u2019 interest to act in good faith as an example to other organisations who may be compromised, so future victims would be more inclined to pay.<\/p>\n

But Hopkins adds: \u201cYou can\u2019t rely on them to not be what they are, which is criminals.<\/p>\n

\u201cThey\u2019ll go off and give us screenshots saying \u2018here\u2019s us deleting things\u2019\u2026 you don\u2019t know if they\u2019ve made a copy, or what they\u2019ve done beyond that.<\/p>\n

\u201cThey will show you what you need to see so you\u2019ll make your payment, and you\u2019ve got no access to validate any of these things.\u201d<\/p>\n","protected":false},"excerpt":{"rendered":"After a week of outages, hundreds of millions of students\u2019 data stolen, delayed assignment due dates and school…\n","protected":false},"author":2,"featured_media":676071,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[43,44,41,39,42,40],"class_list":["post-676070","post","type-post","status-publish","format-standard","has-post-thumbnail","category-headlines","tag-headlines","tag-news","tag-top-news","tag-top-stories","tag-topnews","tag-topstories"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/posts\/676070","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/comments?post=676070"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/posts\/676070\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/media\/676071"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/media?parent=676070"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/categories?post=676070"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/tags?post=676070"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}