Is ransomware really as bad as we think it is?