Good point, we have no idea how many private repos have been compromised and I assume people won't come forward either.

The messed up part is that the repos are probably worth waaaay more than the ransom, especially if the companies are making money.

I wonder how many security people will be walking out the door TBH.