How about, companies who pay ransoms get a fine that's 10x the ransom. It slides up toward 1000x over two years. Kind of like deprecating an API slowly by decreasing its responsiveness.