Two-thirds of companies pay ransomware demands: But not everyone gets their data back