Modern ransomware attacks do recon and exfiltration for weeks or months before pulling the encryption trigger.

The attackers knew it was a hospital network and clearly didn’t care that people would die.