If they can get through the Anti-virus programs and the firewalls then yup.

If they can get through those without being tracked down, that is.

I wouldn’t want to antagonize a government or extremely wealthy corporation with cyber-extortion.

(Er, nor anyone else, but especially not powerful dangerous power-&-control-oriented organizations with effectively unlimited resources and/or military forces including cyberspace warfare units.)

If you want more info about what’s being done, you might want to check out https://www.cybercom.mil/ . Messing with US oil infrastructure definitely got their attention. What exactly they chose to do about it may be a tactical decision, and is no doubt classified.

If the companies (and government) followed suggestions on locking down their networks, they could prevent almost all of it.

But as long as their cost-benefit calculation is “it would be too expensive to do the right thing” then it will continue to occur.