Easy to go around that, companies will just pay an offshore company that can recover the decryption key (and they do so by using part of what you pay them to pay the ransom)