Paying these ransoms should, in fact, be criminalized. If it was, the attacks would basically go away. Even if you assume some ransom payments would still happ

Paying these ransoms should, in fact, be criminalized. If it was, the attacks would basically go away. Even if you assume some ransom payments would still happen under the table, the amounts would have to be drastically lower (there's a limit to how much can be hidden on a company's balance sheet) meaning much less profit for the hackers and less incentive to attack.