I think (right now) there isn&#x27;t a way to really mass-target people illegally if you have their medical data. Blackmail requires some non-zero amount of effort per user.<p>Compare this to getting a password dump from a social networking site and trying those emails&#x2F;passwords in an automated way against sites like paypal&#x2F;gmail&#x2F;banks etc.<p>EDIT: from the article<p><pre><code>    &quot;TrapX also found a bug called Citadel, ransomware that’s designed to restrict a user’s access to his or her own files, which allows hackers to demand payment to restore that access&quot;</code></pre>