It's a gray area - most big companies will get cybersecurity insurance - Then the insurance company pays the ransom (assuming your policy covers it.). When working at a Small Cap financial services company, our policy cost north of $2MM a year.
re "at least make it over Christmas"
A piece of advice I picked up from an old manager prior to his retirement, there's never a good time to lay someone off. Once you know you need to let someone go, don't delay. He once waited until after the Holiday season to layoff one of his team members thinking it was the 'right' thing to delay. She was very upset - "why didn't you tell me sooner, I wouldn't have spent so much money on presents!" Never assume what's best for someone in these situations, you'll often get it wrong.