The companies you comment about typically haven't invested in the time/money/system-updates (a lot less than the ransom demands) that would have kept there systems secure.

However, the article is actually about :

“companies that facilitate ransomware payments to cyber actors on behalf of victims, including financial institutions, cyber insurance firms, and companies involved in digital forensics and incident response, not only encourage future ransomware payment demands but also may risk violating OFAC regulations.”

@FearlessFly The fines are not because they didn't take necessary precautions, which they should have. The fines are for giving in to ransom demands from sanctioned entities, if I'm not mistaken.

@barjoe To be clear, the fines are not for the 'ransomed' companies, they are for the entities that "facilitate ransomware payments to cyber actors on behalf of victims"

@FearlessFly The victim companies hired security firms who paid ransom and will be fined. The ransomwear hackers are obviously subject to prosecution if they ever catch them.