When trust becomes the attack surface
The reported cyber attack involving Canvas and the subsequent ransomware payment will inevitably trigger familiar debates around paying ransomwares.
Most organizations facing ransomware attacks avoid publicly confirming whether a payment was made. Even where payments occur, communications are typically cautious, limited, or deliberately ambiguous.
Admitting to a ransomware payment creates legal, regulatory, reputational, and ethical complications. It can invite scrutiny from customers, insurers, regulators, and shareholders. It may also create concern that the organization has become vulnerable to future extortion attempts.
On one hand, transparency can be viewed positively. Stakeholders increasingly expect honesty during cyber incidents, particularly where personal data is involved. Attempting to conceal the reality of an attack can create longer-term trust issues if details later emerge through other channels.
For many organizations, the decision to pay a ransom is ultimately driven by operational and financial calculations rather than principle alone. If they don’t have things like...
Copyright of this story solely belongs to techradar.com. To see the full text click HERE
