US government body paid $1M to hackers who never locked a single file