The impossible choice Canvas faced shows why ransomware payment bans won't work

The ransomware attack against Canvas and its parent company, Instructure, will eventually be remembered as far more than another cybersecurity incident. But what happened during finals week across schools and universities in North America exposed a growing conflict between public policy and operational reality.

Modern institutions have become dependent on centralized cloud platforms that many take for granted until they stop working. It's easy to nod your head in agreement with the authorities' instructions not to pay a ransom demand until you see students unable to access exams, coursework, assignments, and internal communications at one of the most stressful moments of their academic year.

Paying hackers rarely ends the story

Caught between a rock and a hard place, Instructure CEO Steve Daly later confirmed the company had reached an agreement with the ShinyHunters group to recover the stolen data and prevent further extortion attempts against affected schools and universities.

In a candid message to customers, Daly admitted institutions "deserved more" from a platform trusted by thousands of educational organizations globally. Although normal service was eventually restored, cybersecurity experts and law enforcement agencies continue to warn anyone who will listen that ransom payments fund crime and seldom end well.

Instructure's response captured that tension perfectly. Faced with the potential exposure of billions of private student and teacher messages, personal records, and internal communications spanning nearly 9,000 schools, the company ultimately prioritized immediate containment over a broader deterrence strategy.

In a bid to make the nightmareish problem go away, Instructure later confirmed it had reached an agreement with the attackers that included payment terms tied to assurances that stolen data had been deleted. From the moment the ransom was paid, many debated online if they had also been added to a sucker list that would attract more attackers in the future.

Why governments are trying to stop companies from paying hackers

Many governments continue to encourage organizations to refrain from, limit, or outright ban ransomware payments. It now appears that this contradiction will be central to what happens globally with ransomware.

Increasingly, policymakers argue that organizations should no longer fund cybercrime groups. But businesses, schools, healthcare institutions, and infrastructure operators continue to act emotionally when they need an escape route to return to normal quickly.

Criminal groups operate within a highly structured business model focused on disrupting systems, negotiating, psychologically pressuring victims, and collecting money. Governments believe that restricting access to finance is a way to reduce the economic motivation behind the attack.

Among the countries aggressively advocating that public sector bodies and operators of critical national infrastructure never pay ransomware demands, the UK stands out. Under the proposed law, schools, National Health Service (NHS) organizations, local councils, and critical national infrastructure operators would be banned from paying any ransom demands.

Organizations could still choose to pay private companies for recovery-related services. But the transactions would be subject to a mandatory obligation to report them to authorities before the transaction is completed. Authorities may then have sufficient information regarding ongoing negotiations to intervene before any settlement agreements are finalized.

Public sector bodies operating outside of the prohibition would also be required to submit reports on whether they made any payments to unauthorized parties. While the US government has been far less aggressive than the UK, it continues to use other methods to apply pressure.

In addition to continuing to warn organizations about the potential for exposure under sanctions laws for payments made to sanctioned entities, federal agencies have established new CIRCIA reporting obligations requiring public sector bodies and critical infrastructure operators involved in ransomware attacks to provide authorities with timely notice of both ransomware attacks and ransom payments.

Additionally, several states have passed laws prohibiting public sector bodies from making ransom payments.

Why digital dependency has transformed ransomware economics

Groups like ShinyHunters know that disruption would create more pressure than the technical attack itself. But public humiliation of the victim now plays a critical role in the extortion model.

If governments ban organizations from paying ransoms, what practical alternatives exist? In hindsight, obvious examples include better backups, segmentation, incident response planning, stronger authentication, improved monitoring, and faster recovery capabilities, which can be easily suggested now. However, as Mike Tyson famously said, "Everybody has a plan until they get punched in the face."

The reality is that hospitals unable to restore systems could impact patient safety. The Canvas hack on educational institutions even caught Harvard, Oxford, and MIT in the crossfire, among thousands of others.

The public reaction to the attack demonstrated how quickly operational inconvenience can become societal anxiety when critical digital infrastructure fails. Students immediately feared missed deadlines, lost coursework, compromised records, delayed graduations, and exposure of their identities.

Supporters of payment bans argue that continuing to allow payments will ensure attacks increase. The problem is that both arguments contain uncomfortable truths. This is why the future ransomware debate will likely move beyond binary arguments about whether organizations should or should not pay.

Why cybersecurity policies are colliding with operational survival

In the aftermath of another high-profile attack, leaders are once again struggling to address systemic digital dependency in a world where disruption is the primary weapon.

The Canvas attack highlighted the widening disconnect between regulatory ambition and operational decision-making during real-world cyber crises. There is also the problem that centralized platforms can cause widespread disruption across entire sectors from a single breach.

Governments increasingly want to ban organizations from making ransomware payments. But many are facing operational collapse and continue making decisions based on immediate harm reduction. Neither side is likely to change position easily because both are responding rationally to different forms of risk.

The debate is expanding far beyond hackers, malware, and stolen data to how much operational pain governments realistically expect institutions to tolerate. Maybe the big question is how societies built around centralized digital infrastructure can function effectively when disruption itself becomes the business model.

Unlock more exclusive Cybernews content on YouTube.