Hi, I'm not sure if my comment will be read since there are a lot of them already, but what would the best move be for a medium-sized company in this situation?

Hypothetically, the fees won't be as astronomical like in UCSF's case but the importance of the data being held in ransom will still be the same. Should they take the risk of getting their financial/healthcare/IT data uploaded to the public if they don't pay the fee?