Three reasons not to pay cyber-extortionists — and what to do if you get hit.