US fuel pipeline ‘paid hackers $5m in ransom’