The difference is it is not the attacked company that is paying the ransom, typically. It an insurance agency. So the company that was compromised still only pa

The difference is it is not the attacked company that is paying the ransom, typically. It an insurance agency. So the company that was compromised still only pays $X a month, which is probably less than any million-dollar investment.