Instructure pays ransom to Canvas hackers • Hacker News Board

Re: Instructure pays ransom to Canvas hackers

#251

Post by ninjalanternshk » Wed, May 13, 2026, 11:56 AM UTC

bijowo1676 wrote: post #112

jawiggins wrote: post #86

Years ago I attended a conference that had a "fireside chat" with a DoJ official on the topic of these types of ransom payments. He framed the issue as being similar to kidnapping ransoms: When an American is taken hostage each family is inclined to make payment but it fosters an industry around kidnapping Americans. Congress put a stop to it by making it illegal to pay the kidnappers. The industry shifted by ceasing…

This is the way to go. Instead of paying ransom, and creating a ransomware criminal industry out of thin air, its better to force companies to recover and restore from backups and remove monetary incentive for crime. and the executives who failed to carry regular backups obviously should face the music

I still believe in the approach taken by Mel Gibson’s character in “Ransom.”

Offer a reward equal to the ransom amount, to anyone who turns the kidnappers/criminals in to the authorities.

Re: Instructure pays ransom to Canvas hackers

#252

Post by solumunus » Wed, May 13, 2026, 12:01 PM UTC

ninjalanternshk wrote: post #251

bijowo1676 wrote: post #112

Earlier quoted context omitted.

This is the way to go. Instead of paying ransom, and creating a ransomware criminal industry out of thin air, its better to force companies to recover and restore from backups and remove monetary incentive for crime. and the executives who failed to carry regular backups obviously should face the music

I still believe in the approach taken by Mel Gibson’s character in “Ransom.” Offer a reward equal to the ransom amount, to anyone who turns the kidnappers/criminals in to the authorities.

Good luck when most of the random gangs are in countries that, at best, don’t care about this, and often encourage or support it.

Re: Instructure pays ransom to Canvas hackers

#253

Post by rootusrootus » Wed, May 13, 2026, 2:16 PM UTC

Eufrat wrote: post #227

jstan65536 wrote: post #213

Earlier quoted context omitted.

Backups were not Instructure’s problem. Hackers using the threat of exposing private information to extort Instructure’s customers was the problem.

Our PII is leaked all the time. I am fed up with various businesses sending me a free credit monitoring subscription in lieu of actually having proper security controls or damages that incentivize viewing the issue as a serious going concern risk. Leaks are inevitable, but the current situation is absurd. The liabilities and incentives to do anything about them are virtually nonexistent and security is almost always…

I’m tired of it being my problem to fix. You should be able to know everything about me and still not be able to get accounts/credit/whatever in my name.

Re: Instructure pays ransom to Canvas hackers

#254

Post by teddyh » Wed, May 13, 2026, 2:34 PM UTC

bluGill wrote: post #184

zbentley wrote: post #107

Earlier quoted context omitted.

Cryptocurrency mitigates most of those concerns. That's why the flourishing of crypto payment systems has been an unalloyed blessing for cybercriminals.

No it does not. It makes some things harder and some things easier. The public ledger means you can track where then money flowed - you might not know who had it but you know how it flows which is interesting. I don't know if it has happened, but I've heard of proposals to make any bitcoin the traces to some transaction illegal to have, and that means nobody who might get caught will have anything to do with those.

“Payment must be made in small, used bitcoins.”

Re: Instructure pays ransom to Canvas hackers

#255

Post by Giorgi » Wed, May 13, 2026, 3:37 PM UTC

Problem with blackmail is that you never know if they made copies. Unless this is a well elaborated sting operation.

Re: Instructure pays ransom to Canvas hackers

#256

Post by kjkjadksj » Sat, May 16, 2026, 5:02 PM UTC

stavros wrote: post #30

kjkjadksj wrote: post #28

Earlier quoted context omitted.

Why not wait a week and take the site down and ransom them again?

Because why would anyone pay anyone if they were going to do what they threatened you with anyway?

The deal becomes a subscription not indifferent from any other cost of doing business. Great for the hacker. Bad for the IT team incapable of anticipating these attack vectors.

Re: Instructure pays ransom to Canvas hackers

#257

Post by kjkjadksj » Sat, May 16, 2026, 5:04 PM UTC

WillPostForFood wrote: post #33

kjkjadksj wrote: post #25

Earlier quoted context omitted.

While the us stance has resulted in savings on potential ransom, it has also lead to people being kept in prison for very long time until prisoner exchanges might be worked out. That cost to an individuals life being imprisoned is probably far in excess whatever the US might pay. Plus the US prints its own monopoly money and doesn’t really play by the rules of economics anyhow ever since getting off gold standard.

Cash is not the real cost; the cost is by agreeing to continue printing ransom money, you cause more individuals to be kidnapped.

Seems the rate of kidnapping is currently orthogonal from the ransom so it is unclear that they will have a linear relationship in this way as you describe.