US travel company CWT has reportedly coughed up $4.5m to ransomware crooks who stole data and scrambled files.