Even with good backups and a prompt recovery, you could be looking at losing a day or so of data/work across the affected organisation. If the system had been backing up encrypted files for days/weeks then there’s a much higher cost to restoring from older backups
Making sure the systems are actually clean after getting the files decrypted costs too though. The comparison would be (due diligence to make sure systems are clean + ransom) vs. (restoring backups + lost work).
