I still very much doubt they actually destroy the data though. They could easily be keeping everything and then once the ransomware stops paying as well, they'll start profiting from what they've stolen.

I wonder if a university could protect themselves from this form of attack by amending their bylaws (or some other similarly legally-binding-and-hard-to-amend policy) to say, "We will not pay any ransoms for X, Y, or Z", and then publicise that decision widely, so any potential criminals know that there's no money to be made in targeting them.

It might, unless the attackers see it as a challenge. Many types of cybersecurity insurance won't pay out if you don't or will be more expensive than paying out, so it also might be an expensive bet to take.

The problem is that smart criminals don't directly attack a single corporation or university, they'll attack a SAAS/IAAS/PAAS provider many of their potential targets use and see what they can get out of the data. In this instance even one university paying out would probably be enough to offset the risk and cost of the criminal operation.

In many cases, paying out is also the economical choice to take, especially in ransomware attacks. Even if backups were made, tested and recent, paying a million here and there might still be worth it if not doing so would cost weeks or even months of work and employees and students lacking IT services. With modern education being run like a business, I'm not sure if it'd even make sense to bet on such a statement to be worth it. You may shoot yourself in the foot when you eventually do get hit and you need to either spend lots of time and money or break the promise you made on your website (betraying your employees and students in the process by showing that you cannot hold up the values you claim to have).

Maybe so. In this case the breach occurred at a third party software vendor. You’d need to write a similar guarantee into any contracts you signed with vendors.

I don't see any incentive unless they have a brand name and do repeat business.

If a significant number of players defect, the scam as a whole would stop working.

Presumably all competent scammers benefit from being able to repeat the scam, and would lose out if the scam stopped working, so they all have an incentive not to defect.

Scams like this depend on the scammers understanding the incentives better than their targets and so it’s reasonable to assume that the scammers are aware of the context.

However - this is probably true as well:

https://news.ycombinator.com/item?id=23949046