Paying the ransom is the recommended first step, since it guarantees the return of the decryption key.

The incident is a confidentiality breach only, since the files themselves were never removed from the server.

The backups are safe, because ransomware encrypts only the local system drive and never network shares.

The backups are likely to have been encrypted too, because a permanently mounted share is reachable by the ransomware; only offline, tested backups reliably survive.