US insu rance giant CNA Financial paid $40 million ransom to regain control of systems: report