But with how easy it is to deploy ransomware and how frequently you can get a major hit, it's a pretty pyrrhic victory to not pay. Right now there's no reason t

But with how easy it is to deploy ransomware and how frequently you can get a major hit, it's a pretty pyrrhic victory to not pay. Right now there's no reason to not keep on shooting out ransomware - it's an impersonal, easy to deploy, low cost, scalable form of malware which has a very high and noticeable impact on end-users, who often have little to no recourse or means of mitigating the damage. It's of virtually no risk to the persons deploying the ransomware to deploy the software or collect the money. With other ransom scenarios, the cost and risk to the attacker is far greater for every part of the ransom act; refusal to pay has a greater cost to the attacker in every which way. There is no such cost with ransomware at the moment, aside from the initial financial venture to get/make the software. Knowing that the ransomware folk are just going to keep on spamming their software against institution after institution, is it really worth the potential cost of the lost data? If it's student data, is it worth ruining students' academic careers over a principled stand? Is it worth losing a novel you've been working on for 8+ years? Is it worth losing business documents that could cripple your business? It's not as clear cut with ransomware as it is with other forms of ransom and extortion just because of how stinking' easy it is to do ransomware.