Why aren’t the penalties for the authors of such useless maliciousness far far harsher?
You mean like drawing and quartering them? Personally, I think that’s too mild. The problem is it’s an international crime which takes place in a virtual crime scene. What they steal is really never removed from your premises, and has no physical existence: it’s virtual property. Often, the victim did the damage themselves by installing something. The victims are in the USA, the ones committing the crime are in Siberia or China or Nigeria, or somewhere else equally untraceable and inaccessible, and they demand their payoff in untraceable, instantly transferable, virtual money, bitcoins. How do you find them, much less arrest them?
They’re in Russia, therefore untouchable.