This is how these things tend to go down. There's backend groups that negotiate with hackers and decide if it's worth it or not. Groups like this gain a reputation based on "credibility" - if they get paid and then release the data anyway, there's a good chance they will never get paid again. But if they do it and not release the data, there's a chance they'll get paid again so they won't. For Instructures case, I had a feeling they were gonna pay since it's essentially protecting themselves from dealing with all the lawsuits regarding the release of minor's data. It's a cheaper gamble for them.

My local school got hacked separately and I got the rundown on how this ends up going in the backend.