UK government risking 'catastrophic ransomware attack'