The City of Portland has not had to pay and we have built controls to protect the City network. However, this is still a possibility and a reason to stay vigilant when interacting with email or phone calls.
Paying the criminals incentivizes others to continue to phish users and ransom data. Baltimore did not pay in early-May and they have been down for more than a month. Riviera paid, now we will see how easily they recover. Both Baltimore and Riviera have a long process of cleaning up the infection and understanding all parts of their networks that are infected. Baltimore's ransomware has cost more than $25M. Riviera is not done with costs. They are likely to pay a proportional amount to Baltimore after cleanup.