Paying cyber criminals is not incident response – it is the cost of failed prevention

Instructure’s latest update says the company reached an agreement with the unauthorised actor involved in the incident. According to the statement, the data was returned, Instructure received digital confirmation of destruction through “shred logs,” customers will not be extorted, and individual customers do not need to engage with the actor directly.

That may sound reassuring, and Instructure did sound confident. But it should not be treated as closure.

The uncomfortable question is what an “agreement” with a cybercriminal actually means. If money was paid, or if any valuable concession was made, then the organisation has not simply resolved an internal crisis. It may also have helped finance the criminal economy that created the crisis in the first place, and maintain other, much more nasty criminal activities (e.g., people smuggling, drug trafficking, paedophilia, money laundering).

Law enforcement has warned about this for years. The FBI says paying a ransom does not guarantee that an organisation will get its data back, and that payment encourages attackers to target more victims and incentivises others to join this type of crime. CISA has also warned that some victims who pay are targeted again, extorted for more money, and that payment can encourage the ransomware business model.

That is the real problem with relying on “assurances” from criminals. Once data leaves an organisation’s environment, control is lost. A shred log may show that one copy was deleted from one system, by one actor, at one point in time. It cannot prove that the data was never copied, cached, shared, sold, transferred to affiliates, or retained for future leverage.

This is why paying does not end the risk. It can mark the victim as someone willing to negotiate. It can tell other criminals that the organisation is sensitive to pressure. It can also create a roadmap for future attacks: which data mattered, which customers created reputational pressure, and what kind of threat forced the organisation to respond.

The bigger issue is how organisations get into this position in the first place. In many cyber incidents, ransom payment is not a strategy. It is the final consequence of years of underinvestment: weak vulnerability management, delayed patching, poor monitoring, overexposed systems, insufficient segmentation, weak identity controls, inadequate third-party oversight, and untested backups.

These controls are not exotic. At RightSec, we tell organisations on a daily basis to keep operating systems, software, and applications up to date; run updated anti-malware tools; back up data regularly; verify that backups work; secure backups away from the main network; and maintain a continuity plan. In other words, the cheaper and more effective response is usually prevention: patch before compromise, monitor before exfiltration, and recover from clean backups before criminals control the negotiation.

Whilst backups do not undo a data theft, they do reduce the pressure to pay when systems are encrypted or operations are disrupted. Vulnerability and patch management reduce the chance that attackers get in at all. Strong access controls and monitoring reduce how far attackers can move. Segmentation and strong access controls limits damage. Encryption limits what can be read. Tested incident response plans stop panic from becoming policy.

The human impact should not be minimised either. In an education platform, breached data is not just “names and emails.” It may include identifiers, communications, behavioural records, relationships, and contextual information about students, staff, and institutions. Even when financial data or passwords are not involved, that information can still be used for phishing, impersonation, harassment, social engineering, and future extortion.

So, the lesson from this incident should not be: “The data was returned, therefore the problem is over.”

The lesson should be: an organisation that ends up depending on a criminal’s promise has already lost control of the situation.

Paying may buy time. It may reduce immediate public pressure. It may even prevent a leak in some cases. But it does not buy certainty, and it does not repair the security failures that made the payment attractive or necessary in the first place.

When organisations neglect basic cyber hygiene, the eventual cost is not only financial. Customers, students, staff, and the public absorb the risk, while organised cybercrime gets paid.

That is not incident response. That is a transfer of consequences from the organisation that failed to protect the data to the people whose data was exposed.

If it’s not over yet, what to do next?

If you are one of the impacted organisations currently responding to this incident: Hold your overly confident comms! Continue with caution, always monitoring for leaks and phishing, and communicate clearly and realistically with affected communities.