06/02/2026
Canvas paid the ransom.
And yeah, everyone hates that sentence.
Security people hate it because paying attackers keeps the business model alive. Legal hates it because nothing about ransom negotiations is clean. IT hates it because it turns one awful incident into a precedent.
But when you’re staring at stolen student data, disrupted classes, panicked schools, and a threat actor promising to dump the goods?
The “never pay” stance gets a lot harder to say with a straight face.
That’s why prevention matters so much. Patching. MFA. Offline backups. Endpoint visibility. Not glamorous. But neither is explaining to parents why the homework portal is now a bitcoin checkout page.
We broke down how to protect your school from a cyberattack here: https://hubs.ly/Q04jK02x0