What if the malware changes a medical record (maliciously or accidentally), and the discrepancy leads to a lost life? Seems strange to hang lives on the word of criminals, if lives are really at stake.