Should You Pay for a Ransomware Attack?