Most organizations that paid a ransom were hit with a second ransomware attack