Eric Souza recounted a large ransomware incident that encrypted 20,000 machines and initially sought $2.5 million; he said organizations often pay because restoring operations across many sites can take months even when backups exist.