Companies impacted by ransomware often have to weigh the cost of the ransom against the long-term impact to the business. But Treasury Department sanctions could potentially make the price of enduring such a cyber incident even steeper.