Was watching the website of the organization that hacked Canvas (ShinyHunters) and at some point in the last ~3 hours it seems that Canvas was removed from their list.

The website states:

What happens after resolution?

Once we come to an agreement and finalised, the data is deleted and you will not be listed on this site. We never attack you nor contact you again.

Since Canvas isn't listed here any more I would say that it seems fairly safe to assume they paid up and the data won't be posted.

In regards to changing passwords:

To the best of my understanding there was a fairly brief period this morning where the group was redirecting users to a fake login page and stealing passwords. If you logged in today then I would get on that (especially if the login page looked strange)
There were no passwords stolen in the original leak according to all the reports that I've seen.
(But feel free to change your login if you want, obviously)