There's three possible outcomes: 1. The victim organization that has my data gets everything encrypted and is forced to pay a ransom. 2. The same happens, but

There's three possible outcomes: 1. The victim organization that has my data gets everything encrypted and is forced to pay a ransom. 2. The same happens, but the hackers also release the stolen data, including my PII. 3. The hackers just sell the stolen PII from the start. As a consumer, I far prefer option 1. Maybe it will teach them to protect their system, and my PII, better. If my PII is released somehow, well that's what used to happen anyway. So it not happening is an improvement.