Ransomware and the Payment Decision: OFAC Sanctions, Reporting Duties, Insurance, and Negotiating With Attackers

Summary. This article treats the decision whether to pay a ransomware demand as the legal problem it has become, rather than a purely technical or financial one. It explains why paying is not generally illegal in the United States but can violate sanctions law on a strict liability basis, and how OFAC, FinCEN, and the federal criminal statutes reach victims, insurers, negotiators, and banks. It then maps the reporting duties that a ransomware attack and a ransom payment each trigger, from CIRCIA and NYDFS to the SEC, HIPAA, the FTC Safeguards Rule, and state breach statutes, and explains why paying never cancels a notification obligation. Separate sections cover cyber extortion insurance and war exclusions, the practical reliability of decryptors and deletion promises, how negotiation is actually run, the ethical and board-level duties that frame the decision, and the litigation that follows. An extended worked example follows a hospital system through a seven-day payment decision, and the article closes with common mistakes, an FAQ, and takeaways.

At 3:10 on a Tuesday morning, the night supervisor at Tamsin Valley Health, a three-hospital nonprofit system in central Pennsylvania, calls the on-call IT manager because the emergency department's electronic health record has frozen. By 4:00 the IT manager has found the same text file on every server he can still reach. It says that a group calling itself Black Lantern has encrypted the network, that it has copied 410 gigabytes of "patient and employee material," and that the price of a decryption key and the group's silence is 61 Bitcoin, about $3.6 million at that morning's rate. A countdown on a Tor website shows seven days. By 6:00 the hospitals are diverting ambulances, the chief executive is on the phone with the board chair, and the general counsel is being asked a question that sounds technical and is not: should we pay?

That question used to be answered by the IT department and the chief financial officer. It is now answered, or at least framed, by lawyers, because almost every part of it has a legal dimension. Paying may be a sanctions violation even if no one at the hospital knows who Black Lantern really is. Paying may itself have to be reported to a federal agency within a day. Not paying may mean weeks of diverted ambulances and a negligence theory that writes itself. The insurer may pay, or may say that its consent was required and not obtained. And whatever the hospital decides, it will almost certainly have to notify patients, regulators, and the press, and then defend a class action in which its own forensic report may be Exhibit A.

This article walks through each of those dimensions in the order in which they arrive. For the operational sequence of the first two weeks, see Responding to a Ransomware Attack: A Practical Guide for the First Two Weeks. For check-off tasks, see the Ransomware Readiness and Response Checklist: A Practical Checklist, and for the decision memo, screening record, and notification templates themselves, see the Ransomware Response Toolkit: Decision Memos, Sanctions Screening Records, and Notification Templates.

The short answer

• Paying a ransom is not generally illegal in the United States. No federal statute prohibits a private victim from paying an extortionist. A handful of states prohibit public entities from paying, and the list is growing.
• Paying the wrong person is illegal, and the liability is strict. A payment that reaches a person on the Treasury Department's sanctions lists, or a sanctioned jurisdiction, violates regulations issued under the International Emergency Economic Powers Act, 50 U.S.C. § 1702, whether or not the payer knew. Civil penalties under 50 U.S.C. § 1705 can reach twice the value of the transaction. Willful violations are crimes.
• OFAC strongly discourages payment and will rarely license it. Its September 2021 updated advisory says license applications for ransomware payments involving sanctioned persons are reviewed case by case with a presumption of denial, and that prompt reporting to law enforcement and cooperation weigh heavily in any enforcement decision.
• Paying creates its own reporting duties. Covered critical infrastructure entities will owe CISA a report within 24 hours of a ransom payment under 6 U.S.C. § 681b once CISA's rule takes effect. New York's financial regulator already requires a 24-hour payment notice and a 30-day written justification.
• Paying never cancels breach notification. Data that was copied out was acquired. A promise to delete it is a promise from a criminal. HHS treats encryption of health data by ransomware as a presumed breach under 45 C.F.R. Part 164.
• Insurance often funds the payment, on conditions. Cyber policies typically require the insurer's prior consent, its panel vendors, and documented sanctions screening. War and state-actor exclusions are the coverage battleground; Merck v. Ace is the leading appellate decision.
• The payment often does not buy what it promises. Decryptors are slow and sometimes broken, stolen data can resurface after payment, and paying victims are attacked again. Those facts belong in the decision record, because a board that ignores them will be asked why.

Why the payment decision became a legal problem

Ransomware began as a nuisance: malware that locked a single computer and asked for a few hundred dollars. It became an industry once three things happened. Criminal groups began licensing their encryption software to "affiliates" who break in and split the proceeds, a model known as ransomware as a service. Cryptocurrency made cross-border extortion payments fast and hard to reverse. And, starting around 2019, groups began copying data before encrypting it, so that a victim with good backups still faced a threat to publish. That last development, "double extortion," changed the legal analysis more than any statute, because it turned every serious ransomware event into a potential data breach.

Some groups have since dropped encryption altogether. In 2023 the Clop group exploited a vulnerability in a widely used file-transfer product and extorted many organizations purely by threatening to publish stolen files. Others add pressure by flooding a victim's website, emailing its customers, or calling its executives. In one widely reported 2023 episode, a ransomware group filed a complaint with the Securities and Exchange Commission accusing its own victim of failing to disclose the attack. The point is not the theater. It is that the attacker now understands the victim's legal obligations and uses them as leverage.

So the decision whether to pay has to answer six questions, each with its own body of law:

The rest of this article takes those questions in turn.

Is paying a ransom legal?

The baseline: the extortionist commits the crime

Ransomware is extortion, and federal law aims at the extortionist. The Computer Fraud and Abuse Act, at 18 U.S.C. § 1030(a)(7), makes it a crime to transmit, with intent to extort, a threat to damage a protected computer or to obtain or disclose information from it, or a demand for money in connection with damage already done. The interstate threats statute, 18 U.S.C. § 875, reaches extortionate threats more generally. Neither statute makes the victim's payment unlawful, and no federal statute does as a general matter. The FBI's longstanding position is that it does not support paying ransoms, because payment funds the next attack, but that position is advice, not law.

That baseline explains why most private victims still have a real choice. It also explains why the legal risk concentrates in two places: whom the money reaches, and how it moves.

Sanctions: IEEPA, OFAC, and strict liability

The President's sanctions powers rest mainly on the International Emergency Economic Powers Act. Once the President declares a national emergency with respect to an "unusual and extraordinary threat" from abroad under 50 U.S.C. § 1701, § 1702 authorizes blocking property and prohibiting transactions with designated persons, and § 1704 authorizes implementing regulations. The Treasury Department's Office of Foreign Assets Control (OFAC) administers those regulations and maintains the Specially Designated Nationals and Blocked Persons List (the SDN List). An older statute, the Trading with the Enemy Act, underlies the Cuba program, but IEEPA does the work for nearly everything relevant to ransomware.

Three programs matter most:

• Cyber-related sanctions. Executive Order 13694 (2015), as amended in 2016, declared a national emergency over significant malicious cyber-enabled activities. OFAC implements it through the Cyber-Related Sanctions Regulations, 31 C.F.R. Part 578. Most ransomware-related designations have been made under this program.
• Country programs. Payments that reach North Korean actors implicate the North Korea Sanctions Regulations, 31 C.F.R. Part 510; the Lazarus Group, linked to the 2017 WannaCry outbreak, was designated in 2019. Russia-related programs, including the Ukraine-/Russia-Related Sanctions Regulations, 31 C.F.R. Part 589 and the later programs built on Executive Order 14024, matter because many ransomware operators are reported to be based in Russia. Iran, Cuba, and the occupied regions of Ukraine raise the same issue.
• Designated exchanges and infrastructure. OFAC has designated virtual currency exchanges that it found laundered ransom proceeds, beginning with SUEX in September 2021, and lists digital currency addresses alongside individuals' names.

The designation history is worth knowing because it shows what screening can and cannot catch. In 2018 OFAC, for the first time, listed Bitcoin addresses alongside two Iranians tied to the SamSam ransomware. In December 2019 it designated Evil Corp, a Russia-based group, and its leader. In 2023 it designated, jointly with the United Kingdom, individuals tied to the Trickbot group. In 2024 it designated affiliates of the LockBit operation and, that May, the person it identified as LockBit's leader. Each designation names people and, sometimes, wallet addresses. None names the brand that will appear on next week's ransom note, and groups rebrand. Negotiators and insurers have long treated payments to groups suspected of being Evil Corp under a new name as off limits for exactly that reason.

The liability rule is what makes this dangerous. OFAC may impose civil penalties on a strict liability basis: a U.S. person who makes a prohibited payment violates the regulations whether or not it knew or had reason to know that the recipient was sanctioned. The statutory maximum civil penalty under 50 U.S.C. § 1705(b) is the greater of $250,000 (adjusted upward for inflation each year) or twice the amount of the transaction. A willful violation is a crime under § 1705(c), punishable by fines up to $1 million and imprisonment up to 20 years. In 2024 Congress extended the limitations period for IEEPA violations from five years to ten, so a payment made this year can be the subject of an enforcement action well into the next decade. The reporting, penalty, and licensing procedures are in 31 C.F.R. Part 501, whose appendix sets out OFAC's Enforcement Guidelines. Under those Guidelines, a voluntary self-disclosure cuts the base penalty in half, and the agency weighs the company's compliance program, its cooperation, and whether the conduct was "egregious."

What the OFAC advisory actually says

OFAC first addressed ransomware in an October 2020 advisory and updated it on September 21, 2021, in a document titled Updated Advisory on Potential Sanctions Risks for Facilitating Ransomware Payments. The advisory is agency guidance, not a regulation, but every insurer, negotiator, and forensic firm in the market treats it as the operating standard. Its key points:

1. OFAC "strongly discourages" all private companies and citizens from paying ransom or extortion demands, and recommends focusing on prevention and resilience instead.
2. Facilitators are within the advisory's sights. It names financial institutions, cyber insurance firms, and companies that provide digital forensics and incident response as entities that may violate the regulations by facilitating a prohibited payment.
3. Strict liability applies, so a lack of knowledge is not a defense to a civil penalty.
4. License applications are reviewed case by case with a presumption of denial. A victim that learns its attacker is sanctioned can apply, but should not plan on approval.
5. Mitigation counts. OFAC will treat as significant mitigating factors a victim's meaningful steps to reduce the risk of extortion (the advisory points to cybersecurity practices like those in CISA's ransomware guidance), a self-initiated, timely, and complete report of the attack to law enforcement or CISA, and full and ongoing cooperation with law enforcement during and after the attack.

The practical consequence is a three-part discipline that has become standard. Before any payment, someone qualified tries to attribute the attack, screens every identifier (group name, aliases, wallet addresses, communication handles, and any known individuals) against the SDN List and against threat intelligence about rebrands, and writes the result down. The victim reports to the FBI or CISA early, before the decision is made, because the advisory makes the report part of the mitigation case. And the company documents that it considered alternatives to paying. None of this makes a sanctioned payment lawful. It is what keeps an unknowing one from becoming an enforcement case. The general mechanics of SDN screening, the 50 percent rule, and voluntary self-disclosure are covered in Export Controls and Economic Sanctions: The EAR, ITAR, and OFAC for Ordinary Businesses.

The money trail: FinCEN, banks, and money transmitters

Ransom payments are made in cryptocurrency, which means someone has to buy it and move it. That someone is usually not the victim. It is a negotiation firm or incident response company that holds a cryptocurrency account, often reimbursed by the victim or its insurer, and the bank or exchange that processes the purchase.

The Bank Secrecy Act reaches those intermediaries. The Financial Crimes Enforcement Network's November 2021 advisory, FIN-2021-A004 (Advisory on Ransomware and the Use of the Financial System to Facilitate Ransom Payments), lists red flags for ransomware-related transactions and asks financial institutions to reference the advisory in suspicious activity reports. Banks must file a SAR for suspicious transactions of $5,000 or more under 31 C.F.R. Part 1020, generally within 30 days of initial detection, and money services businesses at a $2,000 threshold under 31 C.F.R. Part 1022. The authority for both is 31 U.S.C. § 5318(g), which also bars the filer from telling the subject that a SAR was filed. The advisory also warned that an incident response or insurance firm that receives funds from a victim and transmits them to an attacker may be engaged in money transmission, which requires registration with FinCEN as a money services business and an anti-money laundering program under the definitions in 31 C.F.R. Part 1010. FinCEN later reported that ransomware-related SAR filings described roughly $1.2 billion in payments in 2021 alone.

For the victim, the practical points are three. A reputable payment intermediary will ask for documentation, screen, and file whatever it must, and a victim should not ask it to do otherwise. The victim should not try to buy and send cryptocurrency itself unless it has done so before and understands the compliance obligations. And the victim should assume that the payment will be visible to law enforcement, which is one more reason to report early.

The criminal tail risks

Beyond willful sanctions violations, two other federal crimes occasionally come up in payment discussions. The material-support statute, 18 U.S.C. § 2339B, prohibits knowingly providing money to a designated foreign terrorist organization. It is a remote risk for ordinary ransomware but not a theoretical one if attribution points toward a designated group. The money laundering statute, 18 U.S.C. § 1956, reaches financial transactions with the proceeds of specified unlawful activity and is aimed at the launderers, not the victim, but it is part of why intermediaries take their compliance work seriously. Neither is a reason to panic. Both are reasons the decision memo should say what the company knew about attribution and when.

State bans on public-entity payments

Some states have taken the choice away from their own governments. North Carolina, in N.C. Gen. Stat. § 143-800 (2022), prohibits state agencies and local government entities from paying a ransom, and even from communicating with the attacker, and requires them to report incidents to the state's Department of Information Technology. Florida, in Fla. Stat. § 282.3186 (2022), prohibits state agencies, counties, and municipalities from paying or otherwise complying with a ransom demand, and separate Florida provisions impose short incident-reporting windows on state and local entities. Other states have considered similar limits. A public entity's counsel should check current state law before anything else, because in a ban state the decision tree has one branch. The bans do not reach private companies, but a private vendor to a public entity may find that its contract borrows the same rule.

The reporting web: what an attack triggers, and what a payment triggers

A ransomware event triggers two families of reporting obligations. The first is incident reporting, which runs from the attack (or from the company's determination that an incident occurred). The second, newer family is payment reporting, which runs from the ransom payment itself. Payment never satisfies, delays, or eliminates the first family. The detail of each regime is in Cybersecurity Regulation for Businesses: The FTC Safeguards Rule, NYDFS Part 500, SEC Cyber Disclosure, and State Laws; what follows is the ransomware-specific map.

CIRCIA: the federal ransom payment report

The Cyber Incident Reporting for Critical Infrastructure Act of 2022, codified at 6 U.S.C. § 681 and following sections, created the first federal duty to report a ransom payment. Under § 681b, a covered entity must report a covered cyber incident to CISA within 72 hours after it reasonably believes the incident occurred, and must report a ransom payment made "as the result of a ransomware attack" within 24 hours after the payment is made. The payment duty applies even if the attack would not otherwise be a covered incident. Entities must supplement their reports when substantial new information becomes available, may file one combined report when an incident and a payment happen within the 72-hour window, and may have a third party (an incident response firm, insurer, or law firm) submit on their behalf, although the duty stays with the entity.

The statute's definitions in § 681 are broad: a "ransom payment" includes money, virtual currency, or other property delivered as ransom in connection with a ransomware attack. The statute also gives reporting entities meaningful protections. Reports do not waive privilege, are exempt from disclosure under public records laws, may not be used to regulate the reporting entity's activities (with limited exceptions), and cannot themselves be the basis of a lawsuit. A covered entity that fails to report faces a request for information, then a subpoena, and ultimately a referral for a civil action to enforce it.

The catch is timing. The reporting duties take effect only when CISA's final rule does. CISA published a proposed rule in April 2024 that would have covered several hundred thousand entities across the sixteen critical infrastructure sectors, using a combination of size thresholds and sector-specific criteria. The statute called for a final rule within 18 months of the proposal, a deadline that passed in October 2025 without one. In 2026 CISA held further town hall meetings on narrowing the rule's scope and burden, and as of this article's date it had not published a final rule, so the CIRCIA reporting duties are not yet in force. When the rule appears, check its effective date and whether the covered-entity definition reaches your client. Prudent covered-sector companies are building the 24-hour payment report into their playbooks now.

NYDFS: the strictest payment rule in force

New York's Department of Financial Services amended its cybersecurity regulation in November 2023. Since December 1, 2023, 23 N.Y.C.R.R. § 500.17(c) has required a covered entity that makes an extortion payment in connection with a cybersecurity event to notify the Department within 24 hours of the payment, and within 30 days to provide a written description of why the payment was necessary, the alternatives to payment it considered, all diligence it performed to find alternatives, and all diligence it performed to ensure compliance with applicable rules and regulations, including OFAC's. That is, in substance, a mandatory version of the decision memo this article recommends for everyone. A company outside New York's jurisdiction that writes the same document is ready for any regulator who later asks the same questions.

The SEC: materiality, not payment

The SEC's July 2023 cybersecurity disclosure rules require a public company to file a Form 8-K under Item 1.05 within four business days after it determines that a cybersecurity incident is material, describing the material aspects of the incident's nature, scope, and timing and its material impact or reasonably likely material impact. The materiality determination must be made "without unreasonable delay" after discovery. The only basis for delaying the filing is a written determination by the U.S. Attorney General that disclosure poses a substantial risk to national security or public safety. The annual disclosure of risk management, strategy, and governance appears in Regulation S-K Item 106, at 17 C.F.R. § 229.106. The statutory foundation is the Exchange Act's periodic reporting provision, 15 U.S.C. § 78m.

Item 1.05 does not expressly require disclosure of whether a ransom was paid. But the payment, its amount, the reasons for it, and whether the company recovered its systems can each be part of the "material aspects" of the incident or its impact, and a filing that is silent on a material fact can be misleading under 15 U.S.C. § 78j(b) and Rule 10b-5 in 17 C.F.R. Part 240. In May 2024 the director of the SEC's Division of Corporation Finance stated that Item 1.05 is for incidents the company has determined to be material, and that companies wishing to disclose other incidents should use a different item, such as Item 8.01. The SEC's enforcement interest is real: in SEC v. SolarWinds Corp., the Southern District of New York in 2024 dismissed most of the agency's claims, including those attacking the company's post-incident 8-K, while allowing claims about pre-incident security statements to proceed. In November 2025 the SEC and the defendants stipulated to dismissal of the remaining claims with prejudice, so the case ended without a finding of liability. The parallel private securities litigation, such as In re SolarWinds Corp. Securities Litigation, 595 F. Supp. 3d 573 (W.D. Tex. 2022) and Construction Laborers Pension Trust v. Marriott International, Inc., 31 F.4th 898 (4th Cir. 2022), turns on whether pre-incident risk disclosures were false. Disclosure counsel's task in a ransomware event is covered in Public Company Disclosure: Periodic Reports, Regulation FD, and Insider Trading Liability.

HIPAA: the ransomware presumption

For health care organizations, the decisive document is a 2016 fact sheet from HHS's Office for Civil Rights titled Ransomware and HIPAA. It takes the position that when ransomware encrypts electronic protected health information, the information has been "acquired" because unauthorized individuals have taken possession or control of it, so the event is a presumed breach under the definition in 45 C.F.R. § 164.402. The covered entity can rebut the presumption only by documenting, through the four-factor risk assessment in that definition, a low probability that the information was compromised. With exfiltration, that showing is usually impossible. The breach rule then requires notice to individuals without unreasonable delay and within 60 calendar days after discovery, notice to prominent media for a breach affecting more than 500 residents of a state, and notice to HHS (contemporaneously for 500 or more, annually for fewer). The statutory source is 42 U.S.C. § 17932, and the civil penalty tiers are in 42 U.S.C. § 1320d-5. OCR announced its first settlement of a ransomware investigation in 2023, and its investigations focus on whether the entity had performed an accurate risk analysis before the attack. The compliance program behind those findings is the subject of HIPAA Privacy and Security Compliance for Covered Entities and Business Associates.

Health apps and other non-HIPAA entities that hold health data may instead be covered by the FTC's Health Breach Notification Rule, 16 C.F.R. Part 318.

State breach statutes, and why payment changes nothing

Every state has a breach notification statute. Most define a breach as unauthorized acquisition of computerized personal information; a growing minority treat unauthorized access as enough. California's statute, Cal. Civ. Code § 1798.82, as amended effective January 1, 2026, requires disclosure within 30 calendar days of discovery or notification of the breach (subject to delays for law enforcement needs or to determine the breach's scope), and a sample copy to the Attorney General within 15 calendar days of notifying residents when more than 500 Californians are notified, and California's privacy statute adds a private right of action with statutory damages for certain breaches caused by a failure to maintain reasonable security. Other states impose fixed periods, commonly 30, 45, or 60 days, and many require attorney general notice above a numeric threshold. Encryption of data at rest by the attacker is not "encryption" for safe harbor purposes; the safe harbors protect data the victim encrypted, not data the criminal did.

The important legal point is simple. Once an attacker has copied personal information, the acquisition has occurred. Paying for a promise of deletion does not undo it, and no state statute treats a criminal's assurance as evidence that the data was not acquired. Some victims have been tempted to argue that paying reduced the "risk of harm" that certain statutes use to excuse notification. That argument is weak on the facts (stolen data has repeatedly resurfaced after payment) and dangerous in practice, because it puts the decision to pay at the center of the notification analysis in the later lawsuit. The state-by-state mechanics are in Data Breach Response and Notification: The Fifty-State Patchwork, Regulators, and Litigation.

The FTC and the financial regulators

The FTC's amended Safeguards Rule, effective in May 2024, requires non-bank financial institutions to notify the FTC within 30 days after discovering a "notification event" involving unencrypted customer information of at least 500 consumers, under 16 C.F.R. § 314.4(j), adopted under the Gramm-Leach-Bliley Act's safeguards mandate in 15 U.S.C. § 6801(b). Apart from that rule, the FTC treats unreasonable data security as an unfair practice under 15 U.S.C. § 45, a theory the Third Circuit upheld in FTC v. Wyndham Worldwide Corp., 799 F.3d 236 (3d Cir. 2015), subject to the specificity limits on remedial orders in LabMD, Inc. v. FTC, 894 F.3d 1221 (11th Cir. 2018). Broker-dealers and investment advisers face the SEC's amended Regulation S-P, 17 C.F.R. Part 248, which now requires an incident response program and customer notice within 30 days for sensitive customer information. Telecommunications carriers have their own breach reporting rule in 47 C.F.R. Part 64.

Outside the United States

Multinational victims face the same pattern abroad. The GDPR requires notice to a supervisory authority within 72 hours. Australia's Cyber Security Act 2024 introduced a mandatory ransomware payment report within 72 hours for businesses above a revenue threshold. France conditions insurance reimbursement of a cyber ransom on a police complaint filed within 72 hours. The United Kingdom consulted in early 2025 on banning payments by public-sector bodies and operators of critical national infrastructure, requiring advance notice of other payments, and mandating incident reports, and in July 2025 the government said it would take those proposals forward. Foreign rules in this area change quickly, so check each one's current status before relying on it.

Insurance: who pays, and on what conditions

Many ransom payments are funded, directly or by reimbursement, by cyber insurance. That fact is controversial; some policymakers argue that insurance makes payment easier and so feeds the market, and New York's financial regulator flagged the concern in its 2021 cyber insurance risk framework. But ransom coverage remains widely available, usually as "cyber extortion" coverage alongside first-party coverage for forensic costs, data restoration, business interruption, and notification, and third-party coverage for claims and regulatory proceedings. The general structure of those policies is covered in Directors and Officers and Cyber Insurance: Towers, Triggers, Allocation, and the Claim You Must Notice and Business Insurance and Coverage Disputes: CGL, E&O, Cyber, and D&O.

Five policy terms decide whether a ransom is covered.

Prior written consent. Nearly every cyber extortion insuring agreement requires the insurer's consent before the payment. A company that pays first and asks later risks losing coverage for the payment, and sometimes for related costs. Consent provisions often say consent will not be unreasonably withheld; that language helps, but it does not excuse failing to ask.

Panel vendors. Policies commonly require, or strongly incentivize, use of the insurer's approved breach counsel, forensic firms, and negotiators. Using off-panel vendors can mean reduced reimbursement rates or a dispute about whether the cost was "reasonable and necessary."

Sublimits and coinsurance. After the losses of 2020 and 2021, many insurers introduced ransomware sublimits, coinsurance (the insured bears a percentage), or higher retentions. Read the declarations page and the endorsements together; the extortion limit may be a fraction of the policy limit.

Sanctions and legality conditions. Policies typically exclude or condition coverage for payments that would violate law, and most contain a sanctions clause excusing the insurer from paying where doing so would expose it to sanctions. The insurer will want the screening record before it consents.

War and state-actor exclusions. The most litigated term. In Merck & Co. v. Ace American Insurance Co., 475 N.J. Super. 420 (App. Div. 2023), Merck sought coverage under all-risk property policies for losses it attributed to the 2017 NotPetya malware, which the U.S. and U.K. governments attributed to the Russian military. The insurers invoked an exclusion for "hostile or warlike action in time of peace or war" by a government or sovereign power. The Appellate Division affirmed summary judgment for Merck, holding that the exclusion, read in light of its history and plain meaning, addressed traditional armed conflict and did not reach a cyberattack on a nonmilitary company; the parties later settled. A similar dispute, Mondelez International's suit against Zurich in Illinois state court, settled during trial in 2022. The market's response was to rewrite the exclusion. Lloyd's required its syndicates, beginning in 2023, to include clauses excluding losses from state-backed cyberattacks in standalone cyber policies, and other insurers adopted similar language. Under those clauses, attribution (which governments often announce months later, if ever) can decide coverage. A coverage lawyer should identify the exact exclusion wording on day one.

Crime and computer-fraud policies are a separate line of cases. Courts have split on whether a fraudulently induced funds transfer is "direct" loss "resulting directly from" computer use: compare American Tooling Center, Inc. v. Travelers Casualty & Surety Co., 895 F.3d 455 (6th Cir. 2018) (coverage) with Apache Corp. v. Great American Insurance Co., 662 F. App'x 252 (5th Cir. 2016) (no coverage), and see Universal American Corp. v. National Union Fire Insurance Co., 25 N.Y.3d 675 (2015) (computer fraud rider limited to unauthorized access, not fraudulent content). Those decisions matter when a ransomware event also involves a diverted payment, which happens more often than one might expect.

Tendering is time-sensitive and procedural; the mechanics are covered in Placing and Tendering a D&O or Cyber Claim: A Practical Guide.

Will paying work? The effectiveness record

There is no law on this question, but it is where most payment decisions are won or lost, and courts reviewing a board's process will look at whether the board asked it. Four facts should be in every decision record.

Decryptors are imperfect. A decryptor is software written by criminals, often for a different environment than the victim's, and tested on no one. Victims have reported decryptors that run so slowly that restoring from backups was faster, that fail on large files such as virtual machine disks or databases, or that crash partway through. Colonial Pipeline paid about $4.4 million in May 2021 and was widely reported to have relied substantially on its own backups because the decryptor was slow. Before paying for a key, demand "proof of life," a test decryption of sample files chosen by the victim, and have the forensic firm assess whether the decryptor works on the systems that matter.

Deletion promises are unenforceable and often false. A group that promises to delete stolen data offers no verification beyond a screenshot or a video. Data has resurfaced after payment, sold to other criminals, posted by a disgruntled affiliate, or leaked when the group collapsed. The 2024 attack on Change Healthcare illustrates the problem: its parent company publicly confirmed paying a ransom of about $22 million, the group then vanished with the money without paying its affiliate, in what was widely described as an exit scam, and the affiliate resurfaced with the data and a new demand.

Payment marks the victim. Industry surveys consistently report that a substantial share of paying victims are attacked again, sometimes by the same affiliate through a door left open.

Alternatives exist more often than the first night suggests. Free decryptors are sometimes available for older or broken strains, through the No More Ransom project and security vendors. The FBI has, on occasion, obtained keys: when it disrupted the Hive operation in January 2023, the Justice Department reported that the FBI had provided decryption keys to hundreds of victims under attack, averting roughly $130 million in payments. And the share of victims who pay appears to be falling. Coveware, a negotiation firm that publishes quarterly data, reported that the proportion of its clients who paid dropped to roughly a quarter by late 2024, and blockchain analytics firm Chainalysis reported that total ransomware payments declined in 2024. Those are industry figures, not official ones, but they show that refusing to pay is a common, survivable choice.

The case for paying is equally concrete in some situations: no viable backups, life-safety systems down (a hospital diverting ambulances), a business that will fail before restoration finishes, or a decryptor that has been tested and works. The point is not that paying is wrong. It is that the decision has to be made on facts that the record shows someone gathered.

Negotiating with attackers

Most victims who engage with an attacker do so through a specialist negotiator, either a stand-alone firm or a unit of an incident response company, retained through counsel and usually from the insurer's panel. Negotiation is engagement, not commitment: opening a chat on the attacker's portal buys information and time even if the company never pays. It is also where several legal duties converge.

What negotiation is for. A competent negotiator does five things: confirms that the people on the portal actually control the data and keys (proof of life and a file-tree listing of what was taken); learns what was taken, which feeds the notification analysis; buys time for restoration and law enforcement; gathers attribution data (wallet addresses, language patterns, tooling) for the sanctions screen; and, if the company decides to pay, reduces the price. Discounts from the opening demand are common, because the attacker's opening number is often derived from the victim's reported revenue or its insurance limits, which attackers sometimes find in the victim's own files. That last point is a reason to keep the policy itself off the network.

What the negotiator may not do. A negotiator retained through counsel works under counsel's direction and should operate under written instructions: no payment without a written authorization that recites the screening result, insurer consent, and the decision maker; no statements to the attacker that the company would be embarrassed to see read aloud in court; no promise of secrecy from regulators; and no side deals. The negotiator's compensation should be a fixed or hourly fee, not a percentage of the payment, which would give it an interest in a higher number. For public entities in North Carolina, the negotiation itself is prohibited, because the statute bars communicating with the attacker.

Honesty with regulators. Nothing said to an attacker binds the company, but everything the company says to a regulator, a court, or the public must be true. A victim may stall a criminal; it may not tell CISA, the SEC, or customers that "there is no evidence data was taken" while its negotiator is looking at a list of stolen files.

Privilege over the chat. Treat the negotiation transcripts and the negotiator's reports as documents that may be produced. They are communications with a third party adverse to the company and are not privileged in themselves. The negotiator's advice to counsel about strategy may be protected if the engagement is structured through counsel, but courts have been skeptical of privilege claims over ordinary-course incident documents, as discussed below.

Negotiation technique (anchoring, concessions, deadlines, and handling an opponent who is bluffing) draws on the same principles discussed in Settlement Negotiation Tactics: Principled Negotiation, Anchoring, and Handling Hardball in Litigation, with the obvious difference that the counterparty is a criminal and the agreement is unenforceable. The line between a researcher's legitimate bounty request and extortion, which shapes how a company should respond to a demand that arrives without encryption, is analyzed in Paid Vulnerability Disclosure and the Line Between Research and Extortion.

Ethics and governance

Counsel's role and the Model Rules

Outside counsel in a ransomware matter often acts as the "breach coach": coordinating forensics, negotiation, insurance, notification, and law enforcement contact. Several professional duties shape that role. A lawyer may not counsel or assist a client in conduct the lawyer knows is criminal or fraudulent (ABA Model Rule 1.2(d)), which means counsel must not help structure a payment the lawyer knows will reach a sanctioned person, but may advise on the legality and consequences of a proposed payment. Counsel's own duties of competence and confidentiality (Model Rules 1.1 and 1.6(c)) apply when the victim is a law firm, as ABA Formal Opinion 483 (2018) explains, along with the duty to inform clients of a breach that affects their information. And when the client is an organization, counsel represents the entity (Model Rule 1.13), which matters when an executive wants to pay quickly to avoid embarrassment and the board has not been told. The broader ethics framework is in Legal Ethics in Practice: Conflicts, Confidentiality, Fees, and the Duty of Technological Competence.

The board's oversight duty

Whether to pay is, in most companies, a decision for senior management with board involvement, and in a large event the board will want to make it. Delaware law does not require directors to make the right decision. It requires them to make an informed one in good faith. The duty of oversight recognized in In re Caremark International Inc. Derivative Litigation, 698 A.2d 959 (Del. Ch. 1996), and confirmed in Stone v. Ritter, 911 A.2d 362 (Del. 2006), makes directors liable only for a sustained or systematic failure to implement any reporting system or to monitor it, or for consciously ignoring red flags. Marchand v. Barnhill, 212 A.3d 805 (Del. 2019) held that a board must make a good-faith effort to oversee "mission critical" risks, and for many companies cybersecurity now qualifies.

Cyber oversight claims have so far mostly failed. The Court of Chancery dismissed the Marriott derivative suit in Firemen's Retirement System of St. Louis v. Sorenson (Del. Ch. Oct. 5, 2021), and the Delaware Supreme Court affirmed dismissal of the SolarWinds derivative suit in Construction Industry Laborers Pension Fund v. Bingle (Del. 2023), both because the boards had reporting systems and received cyber briefings. Earlier, In re Home Depot, Inc. Shareholder Derivative Litigation, 223 F. Supp. 3d 1317 (N.D. Ga. 2016) dismissed a similar claim. The lesson for a ransomware event is procedural: the board's minutes should show that it received the facts (restoration timeline, screening result, decryptor test, notification analysis, insurer position), asked questions, and decided. A board that rubber-stamps an executive's decision made the night before is in a weaker position than one that met twice and declined to pay. The doctrine is developed further in Fiduciary Duties of Directors and Officers: The Business Judgment Rule, Loyalty, and Caremark Oversight.

Tax treatment

Companies sometimes ask whether a ransom is deductible. There is no published IRS guidance addressing ransom payments specifically. Many practitioners treat a ransom paid to restore business operations as an ordinary and necessary business expense under 26 U.S.C. § 162, or as a theft loss, but the question has not been settled, a payment that violated sanctions law raises separate disallowance arguments, and reimbursement by insurance affects the answer. Treat the tax question as one for the company's tax advisers after the crisis, not a factor in the decision.

The litigation that follows

Data breach class actions and Article III standing

When a ransomware group exfiltrates personal data, a class action usually follows, often within days of the first notification letters, and often in several courts at once. The claims are negligence, breach of implied contract, unjust enrichment, state consumer protection statutes, and, in California, the private right of action for breaches caused by unreasonable security. Federal jurisdiction usually rests on the Class Action Fairness Act, 28 U.S.C. § 1332(d), with removal under § 1453, and the case proceeds under Fed. R. Civ. P. 23.

The first defense is standing. TransUnion LLC v. Ramirez, 594 U.S. 413 (2021) held that every class member seeking damages must show a concrete harm, and that a risk of future harm, standing alone, does not support damages. It built on Spokeo, Inc. v. Robins, 578 U.S. 330 (2016) and Clapper v. Amnesty International USA, 568 U.S. 398 (2013). Ransomware cases sit at the strong end of the post-TransUnion spectrum for plaintiffs, because the theft was deliberate and the data is often published. In Clemens v. ExecuPharm Inc., 48 F.4th 146 (3d Cir. 2022), a ransomware group stole employee data and posted it on the dark web; the Third Circuit held that the employee had standing because the attack was intentional, the data was sensitive and had been published, and her costs of monitoring and protection were a concrete injury. The Second Circuit's three-factor test in McMorris v. Carlos Lopez & Associates, LLC, 995 F.3d 295 (2d Cir. 2021) (targeted attack, misuse of some data, sensitivity) and its later decision in Bohnak v. Marsh & McLennan Companies, Inc., 79 F.4th 276 (2d Cir. 2023) point the same way, as does Webb v. Injured Workers Pharmacy, LLC, 72 F.4th 365 (1st Cir. 2023). Earlier decisions such as Remijas v. Neiman Marcus Group, LLC, 794 F.3d 688 (7th Cir. 2015) and Attias v. CareFirst, Inc., 865 F.3d 620 (D.C. Cir. 2017) found standing in hacking cases, while Beck v. McDonald, 848 F.3d 262 (4th Cir. 2017) and Tsao v. Captiva MVP Restaurant Partners, LLC, 986 F.3d 1332 (11th Cir. 2021) did not where theft by a criminal was not shown or misuse was speculative. The full doctrine is in Article III Standing After TransUnion: Concrete Injury, Traceability, and the End of No-Injury Claims.

What does the payment decision do to this litigation? Two things. If the company pays and the data never appears, the defense has a better argument that the risk of misuse is speculative, although plaintiffs will reply that the company cannot know where the data went. If the company does not pay and the data is published, plaintiffs have the Clemens fact pattern. Neither is a reason to pay. Both are reasons the decision memo should be written as if a court will read it.

On the merits, courts have recognized that a company that collects personal data can owe a duty of reasonable care to protect it, see Dittman v. UPMC, 196 A.3d 1036 (Pa. 2018), and multidistrict breach litigation such as In re Equifax, Inc. Customer Data Security Breach Litigation, 362 F. Supp. 3d 1295 (N.D. Ga. 2019), In re Anthem, Inc. Data Breach Litigation, 162 F. Supp. 3d 953 (N.D. Cal. 2016), and In re Premera Blue Cross Customer Data Security Breach Litigation, 296 F. Supp. 3d 1230 (D. Or. 2017) has sustained negligence and contract theories at the pleading stage.

Privilege over the forensic report

The most consequential document in breach litigation is often the forensic firm's report, because it says how the attacker got in and what the company could have done. Companies try to protect it as attorney-client privileged or as work product prepared in anticipation of litigation under Fed. R. Civ. P. 26(b)(3), the doctrine of Hickman v. Taylor, 329 U.S. 495 (1947). Courts have increasingly refused.

In In re Capital One Consumer Data Security Breach Litigation, 2020 WL 2731238 (E.D. Va. May 26, 2020), aff'd, 2020 WL 3470261 (E.D. Va. June 25, 2020), the court ordered production of the Mandiant report because Mandiant had been retained under a pre-existing services agreement for the same kind of work, its fees were initially paid from the cybersecurity budget, and the report was shared with dozens of employees, regulators, and the company's auditor. It would have been prepared in substantially similar form without the litigation. In Wengui v. Clark Hill, PLC, 338 F.R.D. 7 (D.D.C. 2021), a law firm hit by a cyberattack lost its privilege and work-product claims over its forensic report because there was no separate, non-privileged investigation for business purposes, the report was shared with the firm's IT staff and the FBI, and it was used for remediation. In re Rutter's Data Security Breach Litigation, 2021 WL 3733137 (M.D. Pa. July 22, 2021), reached the same result where the report was commissioned to learn whether a breach had occurred at all.

The surviving structure is the "two-track" investigation: one forensic engagement retained by counsel, under a new engagement letter, to advise counsel for litigation, with a separate team doing remediation for the business. Courts apply the "because of" test for work product and, in the D.C. Circuit, the "one of the significant purposes" test for privilege from In re Kellogg Brown & Root, Inc., 756 F.3d 754 (D.C. Cir. 2014), which builds on Upjohn Co. v. United States, 449 U.S. 383 (1981) and the agent doctrine of United States v. Kovel, 296 F.2d 918 (2d Cir. 1961). Even a well-structured engagement protects only so much: the underlying facts are discoverable, and sharing the report widely waives protection. A Fed. R. Evid. 502(d) order in the litigation limits the damage from inadvertent production but does not create protection that never existed. See Attorney-Client Privilege and Work Product for Businesses: Upjohn, In-House Counsel, and the Common Interest.

Splits and open questions

• Does CIRCIA preempt or coordinate with sector rules? The statute directs CISA to avoid duplicative reporting through agreements with other agencies, but until those agreements exist, entities will file several reports on different clocks.
• Can a payment be "reasonable" if it fails? No court has addressed whether a board that paid for a broken decryptor breached a duty. Under Caremark, the answer should turn on process, not outcome.
• Does a state-actor exclusion turn on government attribution? The new clauses lean on attribution by the government of the state where the computer system is located, but governments attribute slowly and selectively. Expect litigation over the burden of proof.
• Will Congress ban or restrict payments? Bills to require disclosure of ransom payments, or to restrict them for certain sectors, have been introduced repeatedly. Track them, but do not plan around them.
• What counts as acquisition for data the attacker only viewed? Access-based state statutes and the HHS presumption make this less important in practice, but it still matters in acquisition-only states.
• Are percentage-of-ransom fees for negotiators lawful? No rule prohibits them, but they create a conflict that a court or regulator could view poorly.

Practical implications for each side

The victim company. Report to law enforcement early. Screen before engaging on price. Write the decision memo as you go. Get insurer consent in writing. Never let the payment decision delay the notification analysis.

The board. Insist on facts: restoration estimates with and without a key, the screening result, the decryptor test, the notification analysis, the insurer's position, and the law enforcement contact. Meet, minute, and decide.

Insurers. Document the consent decision and the screening record. Coordinate with panel counsel on the sanctions analysis. Expect regulators to ask about payment practices.

Negotiators and incident response firms. Screen independently, register with FinCEN if the business transmits funds, keep fixed fees, follow counsel's written instructions, and never pay without written authorization.

Banks and exchanges. Apply the FinCEN red flags, file SARs, and do not tip off.

Plaintiffs' counsel. Plead the deliberate theft, the publication, and the specific costs of protection to satisfy TransUnion, and seek the forensic report early.

Public entities. Check state law first; in a ban state the only questions are restoration, reporting, and notification. The Ransomware Readiness and Response Checklist: A Practical Checklist includes a public-entity variant.

Extended worked example: Tamsin Valley Health's seven days

Return to Tamsin Valley Health. The facts are invented, but every decision point is one that real victims face.

Day 1, morning. The general counsel, Priya Raman, activates the incident response plan and calls the system's cyber insurer's hotline before 7:00 a.m. The insurer assigns panel breach counsel, who retains a forensic firm under a new engagement letter addressed to counsel, and separately authorizes the system's existing managed security provider to begin containment and restoration under its existing contract. That is the two-track structure that Capital One and Wengui reward. Counsel calls the FBI field office and files a report through CISA's portal. The report is short and factual; it notes that the system has not decided whether to pay.

Day 1, afternoon. The forensic firm finds that the attackers entered through a VPN account of a former contractor with no multifactor authentication, roamed for eleven days, deleted volume shadow copies, and encrypted the virtual machine hosts. The offline backups of the electronic health record are eight days old and appear intact; backups of the imaging archive and the payroll system were on the network and are encrypted. Exfiltration logs show about 400 gigabytes leaving through a cloud storage tool.

Day 2. Counsel retains a negotiator from the insurer's panel on a fixed fee, with written instructions. The negotiator opens the chat, asks for proof of life, and receives two decrypted test files and a file tree that includes a folder labeled "HR_Benefits" and an export from the billing system with patient names, dates of birth, and insurance identifiers. The HIPAA analysis is now straightforward: under the HHS fact sheet and 45 C.F.R. § 164.402, this is a presumed breach, and the exfiltration makes the low-probability showing unavailable. Counsel opens the 60-day clock and starts the state-law analysis for patients in Pennsylvania, Maryland, and New York.

Day 3. The negotiator's threat intelligence team reports that Black Lantern's tooling and negotiation scripts overlap with those of a group that went quiet after one of its members was designated under 31 C.F.R. Part 578 the previous year. None of the wallet addresses provided matches the SDN List, and the named group does not appear on it. The screening memo says so, and says that attribution is uncertain. The insurer's coverage counsel reviews the memo and responds that the insurer will not consent to a payment while the overlap is unresolved, citing the policy's sanctions clause.

Day 4. The board meets by video for two hours. Management presents the restoration estimate: the health record can be restored from backup in six to nine days, with eight days of charting to reconstruct from paper downtime records; imaging and payroll will take three to five weeks without a key and perhaps ten days with one, if the decryptor works. The ambulance diversion can end once the emergency department's core systems are up, which the IT team expects on Day 6 with or without paying. The data-deletion promise is discussed and discounted. The board asks whether a sanctions license is realistic; counsel explains the presumption of denial. The board decides not to pay unless the attribution question is resolved favorably and the insurer consents, and directs management to continue restoration at full speed. The minutes record the facts considered.

Day 5. Black Lantern posts a sample of the HR files on its leak site and lowers its demand to 34 Bitcoin. The negotiator, following instructions, says only that the system is evaluating. The system's communications team issues a statement that says what happened, that patient care continues, and that the system is working with the FBI, without characterizing what data was taken beyond what is known.

Day 6. The emergency department's core systems come back online from backup. Diversion ends. The negotiator advises that the attacker's interest is fading. The board's executive committee confirms the decision not to pay. Because Tamsin Valley Health is a nonprofit and not a public company, there is no Form 8-K; because it is not in New York's regulated financial sector, there is no NYDFS payment notice; because it did not pay, there is no CIRCIA payment report (though counsel notes that the health care sector is within CIRCIA's scope and calendars the 72-hour incident report in case the final rule is in effect).

Day 7. The countdown expires. Black Lantern posts the full HR folder and part of the billing export. The system's notification letters, already in draft, go to patients and employees within the next three weeks, well inside the 60-day limit, with credit monitoring and identity restoration services. HHS and the media are notified because more than 500 residents of Pennsylvania are affected. The class action is filed eleven days later. It cites Clemens. The forensic report, kept within the counsel track and shared only with a small group, is withheld as work product; the remediation provider's separate findings are produced. Imaging is restored in week four.

Did the system make the right decision? Reasonable boards could disagree. What matters legally is that it can show what it knew, when it knew it, who it told, and why it decided, and that it never let the payment question delay or color the notification analysis.

Common mistakes

1. Engaging with the attacker before screening. Talking is not paying, but a negotiator should not discuss price until the sanctions screen has started.
2. Paying before insurer consent. The most expensive procedural error in cyber coverage.
3. Treating "no SDN match" as clearance. Groups rebrand. The screen must include threat intelligence about affiliations, and the memo must say what remains uncertain.
4. Waiting to call the FBI or CISA until after deciding. The OFAC advisory treats a timely report as mitigation; a late report is weaker.
5. Believing the deletion promise. It changes nothing about notification, and relying on it invites a regulator's finding of unreasonable delay.
6. Using the existing security vendor for the privileged investigation. That is the Capital One pattern.
7. Circulating the forensic report. Every recipient is a waiver argument.
8. Letting the communications team speculate. "No evidence that data was accessed" has been the opening line of many complaints.
9. Forgetting the 24-hour payment reports. NYDFS now, and CIRCIA once its rule is effective.
10. No board record. A decision made on a phone call at midnight is hard to defend under Caremark.
11. Keeping the cyber policy on the network. Attackers read it and price the demand to the limit.
12. Public entities negotiating in a ban state. In North Carolina, even communicating with the attacker is prohibited.

Frequently asked questions

Is it illegal to pay a ransom in the United States? Not generally, for a private victim. It is illegal to make a payment that reaches a sanctioned person or jurisdiction, and the civil liability is strict. Some states prohibit their own agencies and local governments from paying.

If our screening shows no sanctions match and we pay, can OFAC still penalize us if it later turns out the attacker was sanctioned? Yes, in principle, because civil liability is strict. In practice, OFAC's advisory says that a documented screening process, a timely report to law enforcement or CISA, and cooperation are significant mitigating factors, and the Enforcement Guidelines in 31 C.F.R. Part 501 give heavy weight to compliance efforts and voluntary disclosure.

Do we have to tell the government that we paid? It depends on who you are. Covered critical infrastructure entities will owe CISA a 24-hour report once CIRCIA's rule takes effect. NYDFS-regulated entities already owe a 24-hour notice and a 30-day justification. A public company may have to disclose the payment if it is material. Other victims have no general federal duty, though reporting to the FBI or CISA is strongly advisable.

If we pay and the attacker deletes the data, do we still have to notify? Yes. The data was acquired when it was copied. No state statute or federal rule treats a criminal's deletion promise as undoing acquisition, and HHS presumes a breach in ransomware events involving health data.

Will our cyber policy cover the ransom? Often, within the extortion sublimit and subject to prior consent, panel requirements, the sanctions clause, and exclusions. A war or state-backed attack exclusion is the term most likely to be disputed in a large event.

Can we keep the forensic report out of the class action? Sometimes, if counsel retained the firm under a new engagement for litigation purposes, a separate team handled remediation, and the report was tightly held. Courts in Capital One, Wengui, and Rutter's ordered production where those conditions were missing.

Should the board decide whether to pay? In any significant event, yes, or at least be briefed before management decides. The board's informed, documented process is the best defense against an oversight claim.

Takeaways

• The payment decision is legal before it is financial: sanctions, reporting, insurance, governance, and litigation all attach to it.
• Report early, screen thoroughly, and write down what remains uncertain.
• No payment, and no promise from the attacker, changes the notification analysis.
• Get insurer consent in writing and know the war exclusion language on day one.
• Treat the decryptor and the deletion promise as unproven until tested.
• Structure the forensic investigation through counsel, keep it separate from remediation, and keep the report close.
• Make the board's record show facts, questions, and a decision.

For the operational sequence, see Responding to a Ransomware Attack: A Practical Guide for the First Two Weeks; for check-off tasks, the Ransomware Readiness and Response Checklist: A Practical Checklist; and for the forms, the Ransomware Response Toolkit: Decision Memos, Sanctions Screening Records, and Notification Templates.

This document is general information, not legal advice for any particular situation; the law changes quickly in this area, and the facts of each incident matter.

Related Documents

Related Articles

• Paid Vulnerability Disclosure and the Line Between Research and Extortion: when a payment demand comes from someone claiming to be a researcher rather than a ransomware group.
• Data Breach Response and Notification: The Fifty-State Patchwork, Regulators, and Litigation: the state notification statutes and breach litigation in full.
• Cybersecurity Regulation for Businesses: The FTC Safeguards Rule, NYDFS Part 500, SEC Cyber Disclosure, and State Laws: the regulatory regimes behind the reporting table.
• Export Controls and Economic Sanctions: The EAR, ITAR, and OFAC for Ordinary Businesses: SDN screening, the 50 percent rule, and voluntary self-disclosure.
• Directors and Officers and Cyber Insurance: Towers, Triggers, Allocation, and the Claim You Must Notice: how cyber and D&O coverage respond to a ransomware event.
• Fiduciary Duties of Directors and Officers: The Business Judgment Rule, Loyalty, and Caremark Oversight: the oversight doctrine behind the board's record.
• Article III Standing After TransUnion: Concrete Injury, Traceability, and the End of No-Injury Claims: the standing defense in breach class actions.
• Attorney-Client Privilege and Work Product for Businesses: Upjohn, In-House Counsel, and the Common Interest: protecting the forensic investigation.
• Settlement Negotiation Tactics: Principled Negotiation, Anchoring, and Handling Hardball in Litigation: negotiation principles that carry over to an attacker's portal.
• Authenticating Text Messages, Chats, and Social Media Evidence: Rules 901 and 902, Metadata, and Deepfake Challenges: collecting and authenticating text messages, chats, and social media evidence.

Related Guides

• Responding to a Ransomware Attack: A Practical Guide for the First Two Weeks: the day-by-day companion to this article.
• Responding to a Data Breach: The First Seventy-Two Hours: the general breach playbook for the first three days.
• Placing and Tendering a D&O or Cyber Claim: A Practical Guide: getting notice and consent right.
• Reporting or Receiving a Security Vulnerability: A Practical Guide for Researchers and Companies: the intake process that can prevent the next intrusion.
• Collecting and Authenticating Messaging and Social Media Evidence: A Practical Guide: collecting and authenticating text messages, chats, and social media evidence.

Related Checklists

• Ransomware Readiness and Response Checklist: A Practical Checklist: readiness and response tasks with authority for each.
• Cybersecurity Regulatory Compliance Checklist: A Practical Checklist: the program requirements regulators examine after an attack.
• D&O and Cyber Insurance Review Checklist: reviewing extortion coverage, consent, and exclusions before renewal.
• Messaging and Social Media Evidence Checklist: A Practical Checklist: collecting and authenticating text messages, chats, and social media evidence.

Related Toolkits

• Ransomware Response Toolkit: Decision Memos, Sanctions Screening Records, and Notification Templates: the decision memo, screening record, and notices discussed here.
• Data Breach and Incident Response Toolkit: From Detection to Notification: general breach forms and notification letters.
• Executive and Cyber Coverage Toolkit: Policy Comparisons, Notice Letters, and Allocation Analyses: coverage notice letters and policy comparisons.
• Digital Message Evidence Toolkit: Collection Protocols, Authentication Declarations, and Rule 902 Certifications: collecting and authenticating text messages, chats, and social media evidence.