School district paid over $38K to end ransomware attack