Introduce obligation to report successful cyber attacks under penalty for delay. EU is already doing it. Also make a fine of 10 times the ransom for paying the

Introduce obligation to report successful cyber attacks under penalty for delay. EU is already doing it. Also make a fine of 10 times the ransom for paying the ransom. Additionally introduce criminal liability for intentionally hiding a ransomware attack in order to pay the ransom. The biggest reason is to starve the attackers of incentive and resources. If you get 10 million dollars from an attack you can hire 10 people for a year to work on more attacks. But it's unlikely that companies will change anything besides reporting in their practices. People are bad at evaluating tail risks of 0.001% chance happening in their lifetime.