Despite resolution not to give in to hackers’ ransom demands, some cities are still paying up after attacks