Learning from Baltimore's disaster, Florida city will pay criminals $600,000 to get free of ransomware attack

I haven’t seen a malware-infected machine in like years. How did this get through their spam filtering/anti-malware software?