"Organisations ... need to appreciate that even if the ransom is paid, it doesn’t necessarily mean that the data will be released back to them," Walker Morris wrote in a note to clients.