My office got hit with one of these attacks about a year ago. Fortunately we back up all of our systems every 8 hours, so we just rolled everything back to the last backup, which was about 2 hours before the extorting began, and the Russian mafia was not buying any more track pants in which to squat on that day.