Nobody:

Me: changes the language setting on networked storage to Russian to avoid them getting ransomed.

I’ve noticed something when I meet a person. They ask what I do, I say cybersecurity blah blah, and their response is almost always one of the following:

1: Interesting, my company/school/church/city/bank got ransomed recently (they proceed to tell me about lost data, how painful it was, etc)

2: Oh cool, I use duck duck go

3: So, do you catch people watching porn a lot?

#DFIR fundamentals note to self (and others who could use the reminder):

For Windows, let's say you're looking through a list of service binaries to see if any have been popped.

You see one with a network connection and think, "found it!" but then you see that netconn is to localhost.

Don't shrug and say, "ah, must not be compromised then, the netconn is benign." Check the binary on the other side of that localhost connection. It's possible you have two malicious files. The service one talking on loopback to a second binary making the netconn to c2 (or another host, etc).