The government helped the gas pipeline operator recoup some of the funds it paid to cyberthieves, but that's unlikely to happen often. Banks should shore up password security to minimize risk and be willing to reject hackers' demands in the event of a breach.