FERPA and other data protection laws contain no penalties for breaches of this nature. They will continue to occur until their occurrence is an existential threat to the business.

The ransom should be public information.