I'm of two minds on this. On the one hand, most ransomware groups are genuine criminal organizations, who shouldn't be payed, ever. On the other hand, governments get what they deserve when they get shutdown by a fellow criminal organization. And when they pay do pay the ransoms, they fund the groups going around sabotaging governments and companies. Criminals funding criminals.

I'd be interested in seeing a breakdown of those costs. How much of that is payment of ransoms, and does it include the cost of offline backups? Afterall, the only defense against ransomware is offline backups.