When companies’ data are held hostage and they are presented with a demand for payment, should they just go ahead and pay?