You shouldn’t criminalize victimhood, but for a municipality to have no backups should be considered criminal negligence - and if you do have proper backups, the cost of restoring them should be a small fraction of the ransom — so in such a setting, paying ransom should involve a criminal indictment even though it shouldn’t be about the payment.

This city had proper backups, and indeed was able to avoid paying ransom. Others weren’t so competent.

Unfortunately, these networks will continue to be insecure and that’s a real problem - right now everyone is pretending that it’s “lose your data or pay” for which backups are useful. However, if a hacker gains foothold into a network, and then, for 3 months, randomly changes record (say, randomly exchanging penalties owed among 1000 people every day through the day), then it’s unlikely backups will help - you’d have a mix of new and corrupt data in every backup set even if you have a daily one going back a whole year (and most places are lucky to have more than a week at daily)