Pay up or not? Ransomware surge has victims facing tough choices