Colonial Pipeline paid hackers nearly $5 million in ransom, sources say