To pay or not pay a hacker’s ransomware demand? It comes down to cyber hygiene