MyPillow must decide whether to be firm or soft as ransomware crims demand pay