Hong Kong Privacy Watchdog Condemns Canvas Owner for Paying Hacker Ransom

Hong Kong’s Privacy Commissioner for Personal Data, Ada Chung Lai-ling, has strongly criticized Instructure, the parent company of the education platform Canvas, for paying a ransom to hackers following a massive data breach. The incident compromised personal data across 9,000 institutions globally, including seven organizations in Hong Kong affecting over 72,000 individuals. Chung argued that the funds used for the ransom should have been invested in strengthening cybersecurity measures instead. She also expressed skepticism regarding the hackers' claim that all stolen data was returned and destroyed, urging affected users to remain vigilant against potential phishing attempts or suspicious communications. Although Instructure stated that an agreement was reached and digital confirmation of data destruction was received, the watchdog emphasized that rewarding illegal activities is inappropriate. This marks the second time the platform has suffered a significant security breach. The commissioner highlighted the need for better protective infrastructure rather than capitulating to criminal demands, raising concerns about the long-term security implications for users worldwide.