Medibank refuses to pay ransom after 9.7 million exposed in hack