It did not grow because the intrusion grew. It grew because working out whose records sit in four terabytes takes eleven months.
A company that pays quietly and says nothing has taken the cheaper path. The sample of known payments is not a sample of payments.
Encryption is the moment the attacker chooses to be seen. It happens after the theft, because the theft is the leverage.
A written requirement that MFA be enabled everywhere is not a control. It is intent somebody then has to enforce against an estate nobody has fully inventoried.
An organisation dealing with an incident should not assume it is dealing with an incident.
The only demand in this database attaching a condition unrelated to payment. Nobody repeated it.
The unit that matters is not the facility. It is the number of organisations that stop when it does.