A ransomware attack is somewhat different to a kidnapping. The entire company knows that the computer systems were suddenly down. The entire IT department knows why. None of them are paid enough to be accessories to a felony. If the CEO chooses not to report to the data protection authorities, they're taking a big gamble.