Is the implication that they paid the ransom?
The report seems to go out of its way to avoid stating why the attacker posted the decryption key.
The discussion at the time was the perpetrators didn't expect to have the effect they did, effectively halting the entire health service for several weeks to months. I think the ethics element as the other commenter stated is a valid one, as one is playing with another's life when you interfere with medical operations, routine or otherwise
Goverment agency hires a contractor for data recovery, the rate is Ransom + flat rate. they just pay the ransom and recover the data.
But security is an expense and people don't like paying money.
A financial company I worked for in mid 2000's decided the only thing they needed to do was buy some encryption for the disks their databases ran on, which of course would do nothing to keep someone from just using SQL to extract all our customers credit card data.
