how often do companies pay ransomware