I don't personally agree with paying the ransom but the logic seems sound. If you pay them, they might keep their word. After all, how much would they get paid

I don't personally agree with paying the ransom but the logic seems sound. If you pay them, they might keep their word. After all, how much would they get paid for a list of passwords compared to a ransom payment? If you don't pay them, they are more likely to either sell or leak the lists. In this case, although easy to say now, the correct answer is not to create public web applications until you know how to store passwords correctly and host databases securely, it's not like the information isn't readily available.