There are reasonable precautions that organizations can take to mitigate a ransomware attack before they happen. You might even say that organizations should be

There are reasonable precautions that organizations can take to mitigate a ransomware attack before they happen. You might even say that organizations should be obligated to have some minimum IT infrastructure in place if they're going to be responsible for customer (or student) data in any fashion. Organizations that try to pinch pennies year after year by avoiding paying for the basics are harming IT in general and they're further harming society by sending money out to criminals that will go on to spend that money on attacking other people and organizations.