Irrespective of whether the ransom is paid, a ransomware attack means organisations have lost control of their information.