For hacked companies, paying a ransom may not work: Many say they paid but were attacked again