Dogged police work into ransomware hacks rarely ends with authorities slapping handcuffs on thieves. The attackers are likely sophisticated foreign nationals operating out of Eastern Europe, perhaps under state protection. The culprits may never be brought to justice. That’s why cybercrime experts say municipalities should spend money up front to protect computer systems and educate employees about the risks — or pay millions after a crippling computer attack. “When you get hit with ransomware, law enforcement cannot come in with a magic wand and fix the problem,” said Scott Augenbaum, a retired FBI agent and current cybersecurity expert. “This needs...