Ransomware attack shuts down operations. Four days of negotiations with the attackers follow, along with forensic investigations and the question: to pay or not?