Paying to get stolen data back following a ransomware attack often seems the only course of action, but you may pay double in the long run