It seems like the attackers are finding the paths of least resistance. Beefing up security at each organization isn’t fixing the underlying problem. It’s just making the next entity the more likely target.
I don’t even know what the underlying problem is though...
Suppose I implement better, but imperfect, security. It now costs an attacker $6 million, in salaries, paying for exploits, whatever, to hack my system. They still can only get $5 million in ransom. The attack isn't worth doing anymore, so they find a different business.
Lack of accountability for either criminals or negligent operators?
Monsoons are not directly caused by individuals, and they cannot be prevented.
This reminds me of the old saying about locking your bicycle on the street. It won't 100% prevent yours from being stolen, but if the other bikes around yours has less secure means of locking, then the thief will likely take those bikes instead of yours.
This also gets taken in dark directions: you don’t even need to run faster than the guy next to you, you just need to trip him up.