You may be presenting a false choice: Even if you pay hackers off, there was still a data breach.