Indeed, not only should it be illegal, but the US Gov should offer any and all assistance for helping organizations get back online after such an attack. If organizations quit paying ransoms pretty soon the bad guys would give it up.