(Caveat: I know absolutely nothing about this particular situation) Paying would make sense because if there was a vulnerability uncovered by the initial explo

(Caveat: I know absolutely nothing about this particular situation) Paying would make sense because if there was a vulnerability uncovered by the initial exploit (that is, account information compromised by the initial phishing attempt) then it is perfectly possible that the restored version will be easily exploitable by the same group. I remember this being the case back in SQL Slammer days -- you could restore from backup but your backup would be infected within minutes.