Sounds impossible to enforce.

The penalty for not paying is often catastrophic. The penalty for paying will have to be similarly impactful.

Right, make the penalty for paying a ransom catastrophic. Very few employees will risk a criminal conviction and years in federal prison just to protect their employer.