I imagine that remotely disabling customers' previously-working machines for subscription ransom is at the very least grounds for a class action.
I'm not a lawyer but I would be unsurprised if there is a criminal angle to this, as well, as this is really no different from any run-of-the-mill ransomware.