The ransomware group has a stupid business plan there. A city govt isn’t gonna pay for the data. There’s no guarantee all copies would be deleted if they pay, and the govt suffers no real consequences if they just do nothing. If they paid, it would just make them an attractive target for further attacks; you know they aren’t going to fix all their security vulnerabilities. And then they tried to auction the data… But they have to actually release it eventually otherwise the ransom is toothless, so potential buyers just have to wait for it to get released for free, which is what happened.
Do they hit people with the ladder if they don’t buy?