I might agree if I had any faith that the people who paid this ransom would do any more than the bare minimum to close this one specific vulnerability and nothing else.
Well, fines are a fixed cost, the risk can be calculated and offset against a bonus. A ransom has an unknown downside. I'd imagine most ransoms would be priced to likely get paid, but ransomers don't really know the biz inside and out, so they might guess a painful or fatal price. but that's a one time cost. the lost revenue is the killer.
I'd expect there will be some serious talks about how much to pay to prevent things like this. 5 million, once? Meh, why bother taking security seriously? I suspect the lost revenue is tougher to swallow.
I dunno. you gotta pay every month forever, for protection against maybe something bad happening someday? It's an insurance premium, but you don't get made whole.
I guess, I'd expect companies to start paying a little for infrastructure so they can buy good insurance policies. backups would get you a lot.
Yea, it seems like a pretty novel situation where I'm almost happy that these gangs are walking through these companies' unlocked front doors and causing enough havoc to be noticed but not enough to hurt them beyond repair. If it becomes enough of an infectious cesspool with diseases that can't be slept off to the point that these sloppy companies are forced to wear hazmat suits to exist in the environment, maybe that isn't such a bad thing in the long run. Before that tipping point, hopefully we don't just breed a large quantity of super bug diseases/ransomware gangs that laugh at decent security.
