One of the US's largest insurance companies reportedly paid $40 million to ransomware hackers