"Organisations ... need to appreciate that even if the ransom is paid, it doesn’t necessarily mean that the data will be ...