Paying ransomware crooks won’t reduce your legal risk, warns regulator