But a lot of this is simply board members and C-Suite not allocating enough dollars for proper hardware, software, and strongly knowledgeable minds to implement good security.
The stolen data was encrypted, so all the hackers were doing was stopping business from being run. With that being said, if you think it's just about 'implementing good security' I think you're out of depth when it comes to just how large of an attack vector it is and how sophisticated the attacks can be. We're talking about an industry where people are willing to cough up millions of dollars to recover data in some cases, meaning that it attracts some of the best talent in the world to coordinate attacks and the attacks can be extremely sophisticated.