Agreed. Vulnerabilities are constantly being discovered and very few organisations have robust patching regimes. Exfil / encrypt / extort has become the standard playbook for ransomware operators.

Doesn’t bode well for companies collecting PII.