There is no reason to believe clouds don't have security issues or software bugs that cause inadvertent data loss. Just because the cloud provider is a big com

There is no reason to believe clouds don't have security issues or software bugs that cause inadvertent data loss. Just because the cloud provider is a big company doesn't mean the security is better. At the end of the day, they are a team of software engineers with all the usual people and org problems and can have usual human mistakes. But cloud solutions are better in practice due to totally non-technical reasons. Here's how - If UCSF can afford to pay millions in ransom, they can definitely afford to hire the right experts to do their IT systems properly. It is likely that they hire the right people, but then the most commonly recommended security policies were considered but not implemented due to resistence from powerful non-security team members inside the organization. (Usually, the highly paid CISO is playing politics with peers to keep the job by ignoring those security experts). If it also possible that the IT+security team is incompetent and is only good for deploying expensive but useless vendor solutions that do a lot of security theater but do very little to improve actual security. Also possible that the vendor solutions are susceptible to be misconfigured easily to become insecure. Public cloud solutions can help overcome these above shortcomings of in-house security+IT teams in a org politics friendly manner.