This is not a success story. Getting lucky that the attacker didn't (maybe?) extract data before ransoming, is not success. You pay way more financially from personal data being leaked than you do from your systems being unavailable. This is pure luck, and an inexperienced attacker - that it wasn't much worse for them.
"We were able to restore everything and paid nothing" - is not a defense