Insurance companies require reporting already, also. And many of the companies getting nailed have insurance, which is, in some respects, driving the increase:

Insurance companies require reporting already, also. And many of the companies getting nailed have insurance, which is, in some respects, driving the increase: companies get a 'free' payout for the ransomware. If you get physical shit stolen, and buy it back, do you have to report it?