Would be nice if there was an "easy button" to recover from ransomware after the fact... guess the best equivalent of that is to maintain good backups.

Interesting, can you provide more info on this scenario? Been seeing a lot of this kind of thing lately...