"We've got all the antivirus stuff in place - there's no sign of a virus. They literally got in, hijacked the server and then ran their encryption software," he said.

A pretty telling example of a regular person's idea of security. If you have your antivirus installed, there can't be any security risk, your ass is covered.

I am sure that this is the same level of understanding held by people who are gatekeepers to databases containing tens or hundreds of millions of people's records in government agencies, hospitals, and other places.

Laws need to be made in this area which treat the theft of these records as a serious crime akin to a bank owner losing all of his customers' cash on the stock market.

This is not at all a new practice. Theres an entire field dedicated to stuff like this. [0]

[0]: https://en.wikipedia.org/wiki/Cryptovirology