“Being breached, paying the attackers and then not notifying law enforcement is something that happens dozens, or perhaps hundreds, of times a day in the United States,” said Alex Stamos, director of the Stanford Internet Observatory.