I'm not an expert, but I do work in information security and I personally would tell people to pay, too. I strongly believe there needs to be a way to reduce the frequency of and counter these attacks, but I don't think banning ransom payment is the way.