why isn’t more being done to improve security and find the criminals?

It is but Law Enforcement and Healthcare I.T. can't keep up with the growing number of threats and threat actors. From the perspective of someone in Healthcare I.T. I've watched lots of money, time, and effort get spent on securing systems but it's never quite enough and it never happens fast enough.

MFA all the things, HIPS on everything, EDR on everything, Zero Trust everything, regular patching of all systems, High End Firewalls, encrypt all the things, bi-annual security reviews, DNS Filtering, regular network sweeps for unknown or unmanaged equipment...and you can still end up getting whacked by a 0 Day exploit in a commercial helpdesk tool. (This is what got Change / Optum).

The criminals typically belong to overseas hacking groups, many of which are in places that Western Law Enforcement can't reach like Russia, Belarus, China, and North Korea.

It's a nearly impossible challenge and it's never going to end as long as these systems have any path to the public internet.