Energy companies are the firms most likely to pay cyberattack ransoms