@GossiTheDog 100% correct.
Company I work for last year suffered a ransomware attack, in some fashion we are still recovering from it almost a year later, most things are up and running, but there are the little systems which everyone forgets about which crop up now and again.
All because security was never invested in... usual story.