At the very least they should require full disclosure, including an analysis of how the hackers were able to breach their systems.

I believe that some laws requiring notification to customers in case of a data breach would already cover this. However, from another article I found this statement from CWT:

"While the investigation is at an early stage, we have no indication that personally identifiable information/customer and traveller information has been compromised."

That appears to be a complete lie based on the chat transcripts, and if so I hope CWT is punished legally for it.

Easy to go around that, companies will just pay an offshore company that can recover the decryption key (and they do so by using part of what you pay them to pay the ransom)

I'm sure criminals would like that. Victims would still have an incentive to pay, but also an incentive not to say anything.

Given that the alternative is usually the business folding, I don't think this is likely to happen.

Edit: also, I don't think that making getting hacked more onerous while keeping software developers completely legally immune from liability for the software getting hacked would be politically sustainable either...

Impossible. Some things are just worth more than any amount of money and punishing the victim will not change that.

> Nothing will change until they make it a felony to pay a ransom.

It already is a felony to pay ransomware attackers in the US, depending on who attacked you.

Many of the principal ransomware gangs are listed as OFAC [1] restricted entities. If you pay them, even indirectly, you are as criminally culpable as if you sent sponsor dollars to ISIS or another terrorist or organized crime entity.

Garmin’s execs are in for a big surprise when the Treasury agents come to visit.

[1]: https://en.wikipedia.org/wiki/Office_of_Foreign_Assets_Contr...

On what grounds would you make a monetary transfer like this illegal? Why a felony? What's the punishment? Who gets punished when a public company does it? You can't charge a company with a felony (usually). What about a private company? LLC? Sole proprietorship? What about my laptop, can I pay a $1000 ransom for that?

I guess same as violating economic sanctions since it is similarly funding a group that is by definition hostile to the US’s economic interests.

Isn’t it already a felony to attack computer systems and hold data for ransom? That doesn’t seem to be working flawlessly.

Yes, but the affected company is the one paying the ransom. Make that a felony and suddenly their choice is to invest in security or risk having their business halted for potentially months.

Or, pay ransoms secretly, which is of course what companies would do.