Ransomware attacks are only possible if you have no backup of your data or infrastructure. They depend entirely on the idea that the attacker can steal all of your data, delete it all from your servers, and you have no way to get it back.
This should never be possible for any responsible business. Yet this happens to organizations all the time, and it seems like there's no punishment for this at all, or recourse for people affected by it.
We need to make a software building code that enforces doing the right thing for all online businesses. It would be the same as the building code, electrical code, and fire code that we require businesses comply to for the safety of the people at those businesses and their customers.
AI is only going to make these attacks happen more frequently. We must have a legal regulation that forces businesses to do what they should have been doing already.