If they were caught in the first place and paid up, the attacker presumably learned enough about the infra to find another way in? Or it was social engineering.

If they were caught in the first place and paid up, the attacker presumably learned enough about the infra to find another way in? Or it was social engineering. Like, is a company who runs its IT infra on Windows XP and pays the ransom likely to switch to the latest and greatest, no expenses spared, in a total and utter overhaul of all their systems? Or will they only try to patch the holes that were already revealed and gloss over the rest? Blame it on the intern, all that.