Canvas hack: is it ever a good idea to pay a ransom, and what happens to the data?

The question of whether firms should pay ransoms to hackers – in some cases millions – is one that thousands of companies face each year. Photograph: Boonchai Wedmakawand/Getty Images

After a week of outages, hundreds of millions of students’ data stolen, delayed assignment due dates and school login pages being defaced by hackers, the US tech firm Instructure – which operates the education platform Canvas, used by education providers worldwide – announced it had “reached an agreement with the unauthorised actor” behind the ransomware attack.

Experts read the careful language as a sign that a ransom has been paid. The company has not confirmed this.