It is wondering if the attackers attack PoS software to encrypt it as part of a ransomware attack or to scrape information about the card to extort even more money. Of course, include the ransomware attack itself.

https://threatpost.com/sodinokibi-ransomware-now-scans-networks-for-pos-systems/156855/