CNA Financial allegedly paid hackers $40 million after Phoenix CryptoLocker ransomware attacked the insurance company’s technology network.