The suit comes about six weeks after the ransomware threatened to post sensitive material online if they weren't paid.