That's where the cyber-insurance money is

from here

I have to be honest that it never occurred to me that cyber-insurance companies fueling ransomware gangs was a problem that could solve itself, but if what happened between AXA and Avaddon catches on then maybe it could. If more ransomware operators that prefer victims with cyber-insurance realize they could cut out the middleman and go straight for the cyber-insurance companies then that could force the cyber-insurance industry to change how it does business.

It works the same way for backups

from here

So Baltimore failed to protect themselves against a ransomware attack and apparently they're now planning to fail again. I'm not sure there's any other way to interpret getting insurance equal to the cost of recovering unless you think you're going to need to recover again.

And you know what, $20M would buy a lot of backups.