Why organizations shouldn’t automatically give in to ransomware demands