Monstercloud, a US ransomware recovery firm, is accused of secretly paying hackers and overcharging victims, highlighting important lessons.