ransomware departure