Most payments are less than $1 million, but 8% of successfully attacked US companies have paid a ransom four or more times, ...