Similar to advanced persistent threats, whalers study how people write, what their email looks like and whatever else they need to know to show potential victims the personal touches to sell the impersonation.
Most cases of ransomware go unreported because the criminals are paid quickly and quietly because the organization does not want the notoriety associated with their reputation.