Yes, but the affected company is the one paying the ransom. Make that a felony and suddenly their choice is to invest in security or risk having their business halted for potentially months.