CNA Financial's $40 million blowout could be one of the biggest ransomware payments yet, Bloomberg reported.