Responding to a Ransomware Attack: A Practical Guide for the First Two Weeks

Summary. This guide walks a company and its counsel through the first fourteen days after a ransomware attack, in the order the decisions actually arrive. It starts with the decision points to settle before acting, including whether the organization is a public entity barred from paying, which reporting regimes apply, and what the insurance policy requires. Twelve steps then cover containment without destroying evidence, the counsel-directed two-track forensic structure, insurer notice, law enforcement contact, scoping, the negotiation channel, sanctions screening, the short-clock regulatory reports, the payment decision and its execution or rejection, communications, the breach notification analysis, and litigation readiness. Each step explains what to do, why, the governing authority, pitfalls, timing, and cost drivers. A timeline table, an extended worked example following a public logistics company through all fourteen days, sections for vendors, customers, and public entities, common mistakes, an FAQ, and takeaways complete the guide.

At 5:45 on a Saturday morning, the dispatch supervisor at Corvane Logistics, Inc., a Nasdaq-listed freight and warehousing company based in Columbus, Ohio, cannot load the routing system. Neither can the warehouse in Memphis or the cross-dock in Newark. By 6:30 the on-call security engineer has found a ransom note on the domain controllers, signed by a group calling itself Nightjar, demanding $6.5 million in Bitcoin and claiming to have copied "your customers, your drivers, your insurance clients." By 7:15 the chief information security officer has called the general counsel, Daniel Okafor, who has three phones ringing and one thought: the next fourteen days will decide whether this is a bad month or a bad decade.

They will. Most of what goes wrong in a ransomware response goes wrong early and procedurally: a server wiped before it was imaged, an insurer notified after a vendor was hired, a forensic report sent to forty people, a regulator's 72-hour clock missed because no one knew it existed, or a payment made before anyone checked who was receiving it. None of those mistakes requires bad judgment. They require only that no one had a sequence. This guide is the sequence.

The legal analysis behind each step, especially the sanctions, reporting, insurance, and governance law that frames the payment decision, is in Ransomware and the Payment Decision: OFAC Sanctions, Reporting Duties, Insurance, and Negotiating With Attackers. The same tasks, in check-off form, are in the Ransomware Readiness and Response Checklist: A Practical Checklist, and the forms referred to below (decision memo, screening record, law enforcement log, insurer notice, engagement letter, regulator notices, customer and employee communications, and board briefing) are in the Ransomware Response Toolkit: Decision Memos, Sanctions Screening Records, and Notification Templates.

The short answer

• Hours 0 to 4: contain, preserve, and move communications off the network. Isolate affected systems without powering them off or wiping them, and assume the attacker can read company email and chat.
• Hours 4 to 24: counsel, insurer, and law enforcement. Retain outside counsel, notify the insurer before hiring vendors, structure the forensic investigation through counsel on a separate track from remediation, and report to the FBI or CISA.
• Days 1 to 3: scope and start the clocks. Determine what was encrypted, what was copied, and whether backups survive. Calendar every reporting clock that applies, because the shortest one controls: 36 hours for banks, 72 hours for NYDFS and CIRCIA, four business days after a materiality determination for public companies.
• Days 2 to 6: negotiate, screen, and decide. Open the attacker's channel only through a qualified negotiator under counsel's written instructions, screen the attacker against the sanctions lists before discussing price, and put the payment decision before the board with a written memo.
• Days 4 to 8: execute the decision. If paying, obtain insurer consent in writing, test the decryptor, and file any 24-hour payment report. If not paying, restore and monitor the leak site.
• Days 7 to 14: notification and litigation readiness. Run the breach notification analysis on facts, not hopes, prepare for the class action that usually follows publication, and brief the board on what comes next.
• Payment never changes the notification analysis. Data that left the network was acquired.

Before you start: decision points

Five questions shape everything that follows. Answer them in the first hour, even if the answers are provisional.

1. Who is the client, and what is it? A private company, a public company, a regulated financial institution, a health care entity, a government contractor, or a public body each faces a different set of rules. A company may be several at once: Corvane is a public company (SEC), owns a New York-licensed insurance agency (NYDFS), sponsors a self-insured health plan (HIPAA), and operates in the transportation sector (CIRCIA, once CISA's rule takes effect).

2. Is paying even possible? If the client is a state agency or local government in North Carolina (N.C. Gen. Stat. § 143-800) or Florida (Fla. Stat. § 282.3186), state law prohibits payment, and North Carolina also prohibits communicating with the attacker. Other states have considered or adopted similar limits; check current law. In a ban state, skip the payment steps and focus on restoration, reporting, and notification.

3. Which reporting regimes apply? List them now: CIRCIA (6 U.S.C. § 681b, subject to CISA's final rule), NYDFS (23 N.Y.C.R.R. § 500.17), the SEC (Form 8-K Item 1.05), banking agencies (12 C.F.R. Part 53 and parallel rules), the NCUA (12 C.F.R. Part 748), the FTC's Safeguards Rule (16 C.F.R. § 314.4(j)), HIPAA (45 C.F.R. Part 164), DFARS for defense contractors (48 C.F.R. Part 252), state breach statutes, and contractual notice clauses in customer and vendor agreements.

4. What does the insurance policy require? Find the cyber policy (on paper or in a location the attacker could not reach). Note the notice provision, the hotline, the panel vendor requirement, the cyber extortion insuring agreement and its sublimit, the prior-consent condition, the sanctions clause, and any war or state-backed attack exclusion. Note whether a crime policy, a D&O policy, or a kidnap-and-ransom policy might also respond.

5. What is the business's tolerance for downtime? Ask operations leaders how long the business can run degraded before customers leave, patients are harmed, or covenants are breached. That number, compared with the restoration estimate, drives the payment decision more than anything else.

Step 1 (Hours 0 to 4): Activate, contain, and preserve

What to do. Activate the incident response plan and convene the core team: general counsel, the chief information security officer, the chief information officer, a senior operations leader, communications, and the executive who will brief the board. Isolate affected systems from the network by disabling network connections, segmenting, or blocking at the firewall. Disable compromised accounts and reset privileged credentials from a clean device. Do not power off, reimage, or wipe affected machines until the forensic firm says so, because memory and logs on them are evidence. Preserve logs (firewall, VPN, endpoint detection, identity provider, cloud audit logs) by exporting them before rolling retention periods overwrite them.

Move the response team's communications out of band: personal phones, a separate messaging platform on devices that were never joined to the corporate domain, or a vendor-provided secure workspace. Attackers routinely sit in the victim's email and chat during the response and read the playbook as it is executed.

Why. Containment stops the spread; preservation keeps the evidence that will decide the notification analysis, the insurance claim, and the litigation. The two are in tension, and the forensic firm's job is to balance them.

Authority. The HIPAA Security Rule requires security incident procedures and a contingency plan, including data backup and disaster recovery, under 45 C.F.R. § 164.308. The FTC Safeguards Rule requires a written incident response plan under 16 C.F.R. § 314.4(h). NYDFS requires incident response and business continuity plans under 23 N.Y.C.R.R. § 500.16. The federal government's joint #StopRansomware Guide (CISA, FBI, NSA, and MS-ISAC) and NIST's Cybersecurity Framework 2.0 describe the technical sequence.

Pitfalls. Wiping and rebuilding before imaging. Paying for a "quick fix" from an unvetted vendor. Discussing the incident on the compromised email system. Overlooking cloud and software-as-a-service environments that share credentials with the encrypted network.

Timing and cost. Hours. Cost is internal time and, if the plan provides one, a retainer with an incident response firm.

Step 2 (Hours 2 to 24): Retain counsel, notify the insurer, and structure the investigation

What to do. Call the insurer's breach hotline, or give written notice under the policy, before hiring any vendor the insurer would pay for. Ask which panel firms are approved for breach counsel, forensics, negotiation, notification, and public relations. Retain outside breach counsel. Counsel then retains the forensic firm under a new engagement letter addressed to counsel, stating that the firm's work is to help counsel provide legal advice in anticipation of litigation and regulatory proceedings. If the company's existing managed security provider or internal team is doing containment and restoration, keep that work on a separate track, under its existing contract, with separate reports. Issue a litigation hold to custodians and IT, suspending deletion of logs, email, and backups.

Why. Three reasons. First, most cyber policies condition coverage on notice and, for many costs, on using approved vendors; late notice and off-panel hiring are among the most common coverage disputes. Second, courts have repeatedly ordered production of forensic reports that were not genuinely prepared for litigation. Third, the litigation hold is a legal duty once litigation is reasonably anticipated, which in a ransomware event involving personal data is immediately.

Authority. Work product protection under Fed. R. Civ. P. 26(b)(3) and Hickman v. Taylor, 329 U.S. 495 (1947); corporate privilege under Upjohn Co. v. United States, 449 U.S. 383 (1981); privilege for non-lawyer agents assisting counsel under United States v. Kovel, 296 F.2d 918 (2d Cir. 1961); the "one of the significant purposes" test of In re Kellogg Brown & Root, Inc., 756 F.3d 754 (D.C. Cir. 2014). Courts denied protection in In re Capital One Consumer Data Security Breach Litigation, 2020 WL 2731238 (E.D. Va. May 26, 2020), where the forensic firm worked under a pre-existing agreement and the report was widely shared, and in Wengui v. Clark Hill, PLC, 338 F.R.D. 7 (D.D.C. 2021), where there was no separate business track and the report was used for remediation and shared with the FBI. Spoliation of electronically stored information is governed by Fed. R. Civ. P. 37(e).

Pitfalls. Letting the existing security vendor's report double as the litigation report. Paying the forensic firm from the IT budget. Circulating the draft report beyond a small group. Asking the forensic firm to write conclusions about legal compliance. For the general mechanics of hold notices, see the Litigation Hold and Evidence Preservation Checklist: A Practical Checklist.

Timing and cost. Same day. Forensic firm costs for a mid-sized ransomware event often run well into six figures and can exceed seven figures for large, multi-site incidents; breach counsel is billed hourly at panel rates. The insurer's retention (deductible) usually applies first. Tender mechanics are covered in Placing and Tendering a D&O or Cyber Claim: A Practical Guide.

Step 3 (Day 1): Report to law enforcement

What to do. Contact the local FBI field office (and, where relevant, the U.S. Secret Service), and file a report with CISA through its online reporting portal or the FBI's Internet Crime Complaint Center. Counsel should make or supervise the contact. Provide the ransom note, the attacker's portal address, any wallet addresses, indicators of compromise the forensic firm has identified, and a short factual description. Ask whether the agency has a decryptor or other information about the variant. Record every contact in a log: date, time, agency, person, what was provided, and what was asked.

Why. Law enforcement sometimes has keys or can identify the group; it can also help with attribution, which matters for sanctions screening. OFAC's 2021 updated ransomware advisory treats a self-initiated, timely, and complete report to law enforcement or CISA, and ongoing cooperation, as significant mitigating factors if a payment later turns out to have involved a sanctioned person. Reporting early also positions the company for the national security delay of SEC disclosure, which requires a determination by the Attorney General.

Authority. The extortion is a federal crime under 18 U.S.C. § 1030(a)(7). OFAC's mitigation factors operate within its Enforcement Guidelines in 31 C.F.R. Part 501. CIRCIA's protections for information reported to CISA, including no waiver of privilege, are in the same statutory chapter as 6 U.S.C. § 681b.

Pitfalls. Waiting until after the payment decision. Sending the forensic report itself to the FBI, which in Wengui contributed to the loss of protection; share facts and indicators instead. Assuming the FBI will tell the company whether to pay (it will say it does not support payment and leave the decision to the victim).

Timing and cost. Day 1. No direct cost.

Step 4 (Days 1 to 3): Scope the incident and start every clock

What to do. Direct the forensic firm, through counsel, to answer four questions as fast as possible: How did the attacker get in? What systems are encrypted? What data left the network, and when? Are the backups intact and clean? Exfiltration analysis uses firewall and proxy logs, cloud storage logs, endpoint telemetry, and, often, the attacker's own file listing obtained through negotiation.

At the same time, build the deadline map. For each regime identified in the decision points, record the trigger (discovery, determination, reasonable belief, payment), the clock, the recipient, the owner, and the form. Corvane's map is in the worked example below.

Why. Every notification decision depends on what data was taken, and every short clock is running.

Authority. CIRCIA requires a covered entity to report a covered cyber incident within 72 hours after it reasonably believes the incident occurred, under 6 U.S.C. § 681b, once CISA's final rule is in effect. As of this guide's date CISA had not published the final rule, so check whether it has since issued and whether its covered-entity definition reaches the company. NYDFS requires notice within 72 hours after determining that a reportable cybersecurity incident occurred, under 23 N.Y.C.R.R. § 500.17(a). The bank regulators require notice to the primary federal regulator within 36 hours after determining that a notification incident occurred, under 12 C.F.R. Part 53 and the parallel Federal Reserve and FDIC rules. Public companies must determine materiality without unreasonable delay and file Item 1.05 within four business days after that determination, under Form 8-K in 17 C.F.R. Part 249.

Pitfalls. Treating the ransom note's claims as fact, in either direction. Deferring the deadline map until scoping is complete. Forgetting affiliates and service providers: NYDFS's 72 hours runs from an incident at a third-party service provider that affects the covered entity, too.

Timing and cost. Initial answers in 48 to 72 hours, with refinement for weeks. The cost is in the forensic engagement.

Step 5 (Days 2 to 3): Decide whether to open the negotiation channel

What to do. Decide, with counsel and the insurer, whether to engage with the attacker at all. If yes, retain a negotiator through counsel, preferably from the insurer's panel, on a fixed or hourly fee rather than a percentage of any payment. Give the negotiator written instructions: the goals (proof of life, a list of what was taken, time, attribution data, and, only if authorized, price), the limits (no payment commitment, no statements about regulators or law enforcement, no threats, no side arrangements), and the reporting line (to counsel, daily).

Why. Engagement is not a commitment to pay. It produces information the company needs whether or not it pays: a file listing helps scope the notification analysis, wallet addresses and language patterns feed the sanctions screen, and a deadline extension buys time for restoration. Opening the channel unprepared, by contrast, can anchor a high price, leak information about the company's position, or provoke early publication.

Authority. No statute governs negotiation by private victims. Public entities in North Carolina may not communicate with the attacker at all under N.C. Gen. Stat. § 143-800. A negotiator that receives and transmits funds may be a money transmitter required to register with FinCEN under the definitions in 31 C.F.R. Part 1010, as FinCEN's November 2021 ransomware advisory (FIN-2021-A004) warned. Counsel's supervision of the negotiator is subject to ABA Model Rule 5.3 on responsibility for non-lawyer assistants.

Pitfalls. Executives opening the portal themselves. Revealing the insurance limit (keep the policy off the network). Agreeing to deadlines the company cannot meet. Promising the attacker confidentiality from regulators.

Timing and cost. Days 2 to 3. Negotiator fees vary by firm and engagement; insist on a written fee basis.

Step 6 (Days 2 to 4): Attribute and screen for sanctions

What to do. Before any discussion of price, have a qualified firm (the negotiator's threat intelligence unit, a separate sanctions screening provider, or both) attempt attribution and screen every identifier: group names and aliases, known affiliates, wallet addresses (including those provided for payment and those seen in the attacker's prior campaigns), communication handles, and any individuals. Screen against OFAC's SDN List and other Treasury lists, and against threat intelligence about rebrands of designated groups. Have sanctions counsel review the result. Record it in a screening memo that states what was checked, when, by whom, the results, and what remains uncertain. Re-screen immediately before any payment, because designations can be added at any time.

Why. A payment that reaches a sanctioned person violates OFAC's regulations even if the payer did not know, and the civil penalty can reach twice the transaction value. OFAC's advisory presumes it will deny license applications for such payments. The screening record is also what the insurer will require before consenting, what NYDFS will ask to see within 30 days of any payment, and what the board needs before it decides.

Authority. 50 U.S.C. § 1702 (blocking and prohibition authority); 50 U.S.C. § 1705 (civil and criminal penalties); 31 C.F.R. Part 578 (Cyber-Related Sanctions Regulations); 31 C.F.R. Part 510 (North Korea) and 31 C.F.R. Part 589 (Ukraine-/Russia-related) for country programs; 31 C.F.R. Part 501 (reporting, licensing, and Enforcement Guidelines). OFAC's Updated Advisory on Potential Sanctions Risks for Facilitating Ransomware Payments (Sept. 21, 2021). The general mechanics of screening are explained in Export Controls and Economic Sanctions: The EAR, ITAR, and OFAC for Ordinary Businesses.

Pitfalls. Treating "no exact match" as clearance. Screening only the group name. Failing to re-screen. Skipping the memo because "everyone uses this negotiator."

Timing and cost. One to three days, often included in the negotiator's fee or billed separately by the screening provider.

Step 7 (Days 2 to 5): Make the short-clock reports and the materiality determination

What to do. File the reports whose clocks run first, using facts known at the time and stating that the investigation continues. Typical early filings: the 36-hour bank regulator notice; the 72-hour NYDFS notice through the Department's portal; the 72-hour CIRCIA report if CISA's rule is in effect and the company is a covered entity; the 72-hour DFARS report for covered defense information; and any contractual notices with short windows. For a public company, convene the disclosure committee, document the materiality analysis (quantitative and qualitative factors, including operational disruption, customer impact, data theft, regulatory exposure, and reputational harm), and file Item 1.05 within four business days if the incident is material, or consider Item 8.01 for an incident not yet determined material.

Why. Short clocks are unforgiving, and regulators expect an initial report on incomplete facts, followed by updates. The SEC's materiality determination must be made without unreasonable delay; a company may not wait for the investigation to finish.

Authority. 23 N.Y.C.R.R. § 500.17(a) (72 hours); 6 U.S.C. § 681b (72 hours, with supplemental reports); 12 C.F.R. Part 53 (36 hours); 12 C.F.R. Part 748 (72 hours for credit unions); 48 C.F.R. Part 252 (DFARS 252.204-7012); Form 8-K Item 1.05 under 17 C.F.R. Part 249 and the annual Item 106 disclosure under 17 C.F.R. § 229.106; the Exchange Act reporting provision, 15 U.S.C. § 78m. Materiality is judged under the standards of 17 C.F.R. Part 240 and the case law discussed in Public Company Disclosure: Periodic Reports, Regulation FD, and Insider Trading Liability.

Pitfalls. Saying more than is known ("no customer data was affected"). Saying less than is known (omitting confirmed exfiltration). Inconsistent statements across regulators. Forgetting insider trading controls: once the incident is material nonpublic information, close the trading window for insiders who know.

Timing and cost. Days 2 to 5. Counsel time; disclosure counsel for public companies.

Step 8 (Days 3 to 6): Make the payment decision

What to do. Prepare a written payment decision memo (the toolkit has a template) covering: restoration options and timelines with and without a decryption key; the condition of backups; the operational and safety consequences of each timeline; what was exfiltrated and the notification consequences, which do not change with payment; the sanctions screening result and its uncertainties; the insurer's position on consent and coverage; the law enforcement contact and any information it provided; the reliability of the attacker's decryptor and of its deletion promise; legal constraints (state bans, NYDFS justification duties, CIRCIA payment reporting); and the recommendation. Present it to the board or its designated committee, which should meet, ask questions, and decide. Minute the meeting.

Why. The decision is the company's most consequential and most scrutinized act in the response. Directors are protected by the business judgment rule if the decision is informed and made in good faith, and exposed under the oversight doctrine if they ignore red flags or abdicate. NYDFS-regulated entities must, within 30 days of any payment, explain why payment was necessary, what alternatives were considered, and what sanctions diligence was done; the memo is that explanation, written in advance.

Authority. In re Caremark International Inc. Derivative Litigation, 698 A.2d 959 (Del. Ch. 1996); Stone v. Ritter, 911 A.2d 362 (Del. 2006); Marchand v. Barnhill, 212 A.3d 805 (Del. 2019); dismissals of cyber oversight claims in Firemen's Retirement System of St. Louis v. Sorenson (Del. Ch. 2021) and Construction Industry Laborers Pension Fund v. Bingle (Del. 2023), which turned on the boards' documented oversight; 23 N.Y.C.R.R. § 500.17(c). The doctrine is in Fiduciary Duties of Directors and Officers: The Business Judgment Rule, Loyalty, and Caremark Oversight.

Pitfalls. Deciding on a phone call without a memo. Letting the deletion promise affect the notification plan. Letting the insurer's willingness to pay substitute for the company's own judgment. Treating the decision as final: new facts (a restored backup, a new designation, a working free decryptor) can change it.

Timing and cost. Usually within the first week; many attackers impose deadlines of five to ten days, often extendable through negotiation.

Step 9 (Days 4 to 8): Execute the decision

If the company decides to pay

What to do. Obtain the insurer's written consent. Re-screen all identifiers. Confirm the payment intermediary's compliance: registration with FinCEN where required, its own screening, and its documentation. Approve the payment in writing, naming the decision maker and reciting the screening result and consent. Negotiate a test decryption of systems that matter before full payment, if possible. After payment, file the 24-hour reports: NYDFS under 23 N.Y.C.R.R. § 500.17(c) and, once in effect, CIRCIA under 6 U.S.C. § 681b. Calendar the NYDFS 30-day written justification. Test the decryptor on isolated copies first, because decryptors can corrupt data; run it under the forensic firm's supervision. Keep restoring from backups in parallel.

Why. The insurer's consent condition, the sanctions rules, and the payment reporting rules all attach at this moment. Testing protects against a decryptor that makes things worse.

Authority. OFAC regulations and advisory as in Step 6; FinCEN's ransomware advisory and SAR rules for the intermediary's bank or exchange under 31 C.F.R. Part 1020 and 31 C.F.R. Part 1022; 31 U.S.C. § 5318(g) (SAR confidentiality).

Pitfalls. Paying from a company account without an intermediary experienced in the compliance steps. Paying the "data deletion" component in the belief that it avoids notification. Running the decryptor on production systems.

If the company decides not to pay

What to do. Tell the negotiator how (and whether) to close the channel; some companies simply stop responding. Accelerate restoration from backups. Monitor the attacker's leak site and other forums through the forensic or threat intelligence firm, and capture what is posted, because published data shapes both the notification population and the litigation. Prepare for publication: the communications plan, the notification letters, and the call center should be ready to go if the data appears.

Why. Refusing is common and often right, but it makes publication likely, which accelerates the notification and litigation timeline.

Pitfalls. Telling the attacker the company will never pay (it gains nothing). Failing to capture leak-site posts with timestamps.

Timing and cost. Restoration from backups can take days to weeks; overtime, contractors, and temporary infrastructure are significant costs, and business interruption coverage may respond.

Step 10 (Days 3 to 10): Communicate with employees, customers, and the public

What to do. Give employees a short script: what happened, what they should and should not do (no discussing the incident on company systems or social media, how to report suspicious contacts, how to handle customer questions), and where to get updates. Give customer-facing staff a holding statement. Notify key customers and partners whose contracts require prompt notice of security incidents. Issue public statements only through counsel-reviewed channels. Prepare for the attacker to contact employees, customers, or reporters directly.

Why. Communications create admissions, and inaccurate ones create claims. Statements to customers and the public must be accurate under the FTC Act's prohibition on deceptive practices, 15 U.S.C. § 45, and, for public companies, the securities laws, 15 U.S.C. § 78j(b).

Pitfalls. "No evidence of data access" before the forensics are done. Different messages in different channels. Ignoring contractual notice deadlines, which are often shorter than statutory ones. For general crisis communications planning, see Preparing a Business Continuity and Crisis Management Plan.

Timing and cost. From Day 1 for internal, Days 2 to 5 for customers, as needed for the public. Public relations firm fees are often covered by the cyber policy.

Step 11 (Days 5 to 14): Run the breach notification analysis

What to do. Once the forensic firm has identified the exfiltrated data set, have a data-mining vendor (through counsel) review it to identify individuals and data elements. Map individuals by state of residence and data type. Apply each state's definition of personal information and breach, its timing rule, and its regulator notice thresholds. For health data, apply HIPAA's presumption that ransomware encryption of protected health information is a breach unless the low-probability showing can be documented, and calendar the 60-day individual notice, HHS notice, and media notice. For non-bank financial institutions, calendar the FTC notice for 500 or more consumers within 30 days. Draft notices, arrange credit monitoring and identity restoration where appropriate, and set up a call center.

Why. Notification deadlines run whether or not the company paid. Most state statutes run from discovery, not from completion of the data mining. Notifying late is a frequent basis for regulatory penalties and a theme in class action complaints.

Authority. HIPAA breach rule, 45 C.F.R. §§ 164.400 to 164.414, and its statute, 42 U.S.C. § 17932; HHS's 2016 Ransomware and HIPAA fact sheet; FTC Safeguards Rule, 16 C.F.R. § 314.4(j); FTC Health Breach Notification Rule, 16 C.F.R. Part 318, for non-HIPAA health apps; SEC Regulation S-P, 17 C.F.R. Part 248, for broker-dealers and advisers; Cal. Civ. Code § 1798.82 (30 calendar days from discovery since January 1, 2026) and the other state statutes. The state-by-state analysis is in Data Breach Response and Notification: The Fifty-State Patchwork, Regulators, and Litigation.

Pitfalls. Waiting for perfect data before notifying. Treating the attacker's deletion promise as reducing the risk of harm. Forgetting business associates' duty to notify covered entities, and covered entities' reliance on business associates' timelines. Mailing notices to the wrong addresses because the HR system was restored from an old backup.

Timing and cost. Data mining commonly takes two to six weeks, so the first two weeks are spent setting it up and making early decisions about populations that are clearly affected. Notification vendor and credit monitoring costs scale with the number of individuals.

Step 12 (Days 7 to 14): Prepare for litigation and brief the board

What to do. Assume a class action if data was published or notification letters are going out. Engage litigation counsel, confirm the hold, review what has been written about the incident for privilege and accuracy, and prepare the standing and merits defenses. Review indemnity and limitation-of-liability provisions in vendor contracts if a vendor's failure contributed. Brief the board on status, remaining exposure, the notification plan, regulatory follow-up (including the NYDFS 30-day report if a payment was made), and the hardening plan. Begin, through counsel, a root-cause and lessons-learned review designed to be separate from the litigation work.

Why. Breach complaints are often filed within days of notification. Early preparation shapes venue, consolidation, and the first motion.

Authority. TransUnion LLC v. Ramirez, 594 U.S. 413 (2021); Clemens v. ExecuPharm Inc., 48 F.4th 146 (3d Cir. 2022) (ransomware publication on the dark web supported standing); McMorris v. Carlos Lopez & Associates, LLC, 995 F.3d 295 (2d Cir. 2021); Fed. R. Civ. P. 23; 28 U.S.C. § 1332(d) and § 1453 for removal under CAFA; Fed. R. Civ. P. 12 for the motion to dismiss. See Class Action Defense Toolkit: From Complaint Through Settlement Approval and Pleading and Attacking Standing in Federal Court: A Practical Guide.

Pitfalls. Letting the root-cause review become a discoverable admission. Making settlement-sounding promises in notification letters. Ignoring the derivative-suit and books-and-records demand risk for public companies.

Timing and cost. Days 7 to 14 and beyond. Litigation counsel costs depend on the number of cases and whether they consolidate.

Timeline and cost drivers at a glance

Worked example: Corvane Logistics, Days 0 to 14

The facts are invented. They are chosen so that most of the regimes in this guide apply at once.

Day 0 (Saturday). Nightjar's ransom note appears at 5:45 a.m. By 9:00 the CISO has isolated the data center and the three regional warehouses at the firewall, disabled the VPN, and reset domain administrator credentials from a laptop that was never on the domain. Nothing is wiped. Daniel Okafor, the general counsel, sets up a group on an encrypted messaging app using personal phones and moves the response team there. At 10:30 he calls the cyber insurer's hotline. The insurer assigns panel breach counsel, Hale & Whitcombe LLP, which by 3:00 p.m. has signed an engagement with a panel forensic firm, under a new letter addressed to the law firm, and has confirmed that Corvane's existing managed security provider will handle containment and restoration under its existing contract with separate reporting. A litigation hold goes out at 6:00 p.m.

Day 1 (Sunday). Breach counsel calls the FBI field office in Cincinnati and files a CISA report. The FBI agent recognizes Nightjar as a recent brand and asks for the wallet address and the portal link. Counsel logs both contacts. The forensic firm finds the entry point: a compromised account on an unpatched remote-access appliance. It finds 1.1 terabytes leaving through a file-sync tool over five days. Corvane's immutable cloud backups are intact but 36 hours old; the warehouse management system's backups were on the network and are encrypted.

Okafor's team builds the deadline map:

Day 2 (Monday). The NYDFS notice is filed through the Department's portal: the facts known, a statement that the investigation continues, and a contact. The commercial team sends the contractually required notices to six shippers. Breach counsel checks whether CISA's CIRCIA final rule is in effect and whether Corvane meets its covered-entity definition; either way, it supplements the Day 1 CISA report so that the 72-hour obligation, if it applies, is met. Counsel retains a panel negotiator on an hourly fee, with written instructions. The negotiator opens the chat and asks for proof of life and a file listing. The disclosure committee meets and asks for an estimate of the operational impact.

Day 3 (Tuesday). The negotiator receives two decrypted sample files and a file tree. It includes the drivers' qualification files (Social Security numbers and driver's license numbers), the health plan's claims extract, and the insurance agency's client list with policy numbers. The threat intelligence team reports that Nightjar's wallet addresses do not match the SDN List and that its code shares lineage with a group that has not been designated, but that one affiliate handle appeared in a forum thread with a person designated under 31 C.F.R. Part 578. Sanctions counsel writes the screening memo and flags the uncertainty.

The disclosure committee determines that the incident is material: routing and warehouse systems are down across the network, several large customers have diverted freight, and sensitive data has been stolen. The four-business-day clock starts.

Day 4 (Wednesday). The board meets for ninety minutes. The payment memo presents two restoration timelines: about nine days for routing from the cloud backups regardless of payment, and 18 to 25 days for warehouse management without a key versus perhaps eight with a working decryptor. Each additional day of warehouse disruption costs an estimated amount that operations has quantified for the board. The memo explains that payment would not change the notification obligations, that the deletion promise is unverifiable, that the insurer has said it will not consent while the affiliate link is unresolved, and that a payment would trigger a 24-hour NYDFS notice and a 30-day justification. The board directs management not to pay unless the sanctions question is resolved and the insurer consents, and to continue restoration at full speed.

Day 5 (Thursday). Corvane files its Form 8-K under Item 1.05, describing the nature, scope, and timing of the incident (unauthorized access, encryption of operational systems, theft of data including personal information) and its material impact on operations, and stating that the company is still assessing the financial impact. It does not mention negotiation. Employees receive the script; drivers receive a separate message about the theft of their files.

Day 6 (Friday). The insurer's sanctions counsel advises that the affiliate link cannot be resolved quickly. The executive committee confirms that Corvane will not pay. The negotiator tells the attacker that Corvane is not in a position to proceed, and stops responding.

Day 8 (Sunday). Routing is restored. Nightjar posts a sample of the drivers' files and the agency's client list on its leak site. The forensic firm captures the posts with timestamps. Okafor's team updates NYDFS, since the publication is substantial new information.

Days 9 to 12. The data-mining vendor begins work on the 1.1-terabyte set. Early results identify about 14,000 drivers and employees with Social Security numbers, about 9,000 health plan participants, and about 30,000 insurance agency clients. Notification letters for the clearly affected driver population go out on Day 12 with credit monitoring; HIPAA notices are scheduled well inside 60 days; the agency's client notices follow New York and other states' rules.

Days 13 to 14. The first class action is filed in the Southern District of Ohio, citing Clemens. Litigation counsel prepares to consolidate and to move under Fed. R. Civ. P. 12 on standing for plaintiffs whose data has not been published. The board receives a briefing on the restoration status of the warehouse system (expected around Day 22), the notification plan, the litigation, the NYDFS follow-up, and a hardening plan that begins with the remote-access appliance.

What Corvane got right is mostly procedural: it called the insurer before hiring vendors, separated the forensic tracks, reported to law enforcement on Day 1, screened before price, made a documented board decision, and never let the payment question affect the notification analysis. The decision not to pay was reasonable. A decision to pay, with a clean screen, insurer consent, and a tested decryptor, would also have been defensible on this record.

If you are the vendor, the customer, or a public entity

The service provider whose platform was hit. Your customers' notification duties may depend on your facts. Give them prompt, accurate, and consistent information, follow your contracts' notice periods, and expect their regulators' rules (for example, NYDFS's coverage of incidents at third-party service providers) to drive their requests. If you are a HIPAA business associate, you must notify the covered entity without unreasonable delay and within 60 days of discovery under 45 C.F.R. § 164.410. Do not decide on payment as if only your own data were at stake; your customers' regulators may ask what you did.

The customer whose vendor was hit. Demand facts under your contract's security incident clause. Run your own notification analysis, because the duty to notify usually stays with the data owner. Calendar your own regulatory clocks, which may run from your knowledge of the vendor's incident. Review indemnity and limitation-of-liability provisions before the vendor's first settlement conversation. See the Vendor Cybersecurity Diligence Checklist: A Practical Checklist for what you should have negotiated.

The public entity. Check state law first. In North Carolina, do not pay and do not communicate with the attacker; report to the state's Department of Information Technology. In Florida, do not pay; observe the state's short incident-reporting windows. Elsewhere, check whether your state has adopted a similar rule and whether public records laws will make your response documents public, which affects what you write. Public entities often have state cybersecurity agency support that private companies do not.

Common mistakes

1. Hiring vendors before calling the insurer. It invites a coverage fight over the largest costs.
2. Using one forensic track for everything. It makes the litigation report discoverable.
3. Wiping systems to restore faster. It destroys evidence the notification analysis and the defense need.
4. Discussing the response on the compromised network. The attacker reads it.
5. Calling law enforcement late. It weakens OFAC mitigation and forfeits possible help.
6. Talking price before screening. It creates pressure to pay before the sanctions question is answered.
7. Missing the 72-hour or 36-hour clock. These are the regulators' easiest findings.
8. Overstating certainty in public statements. "No evidence" is a phrase plaintiffs quote.
9. Paying without written insurer consent.
10. Assuming payment ends the notification analysis. It does not.
11. No board minutes. The decision is the board's best evidence of care only if it is recorded.
12. Forgetting the NYDFS 30-day justification. It is due whether or not the payment worked.

Frequently asked questions

Should we turn off the infected computers? Generally no, unless the forensic firm advises it to stop active destruction. Isolating from the network preserves volatile evidence that powering off destroys.

How soon do we have to call the insurer? As soon as practicable under most policies, and in any event before hiring vendors whose costs you want covered. Read the notice condition; some policies set specific periods.

Will the FBI tell us not to pay? The FBI does not support paying ransoms but leaves the decision to the victim. It may have information about the group, and occasionally decryption keys.

Do we have to file a Form 8-K? Only if the company is an SEC registrant and determines that the incident is material. The determination must be made without unreasonable delay, and the filing is due four business days after it.

If we pay, do we have to tell anyone? NYDFS-regulated entities must notify the Department within 24 hours and explain the payment within 30 days. Covered critical infrastructure entities will owe CISA a 24-hour report once CIRCIA's rule takes effect. A public company may need to disclose the payment if it is material. Others have no general federal duty, but should tell law enforcement.

Can we keep the forensic report confidential? Possibly, if counsel retained the firm for litigation purposes, a separate team did remediation, and the report was closely held. Courts have ordered production where those conditions were missing.

How long does notification take? Data mining often takes several weeks; state and HIPAA deadlines run from discovery, so clearly affected groups should be notified on a rolling basis rather than waiting for the full review.

Takeaways

• Sequence matters more than speed: contain and preserve, then counsel, insurer, and law enforcement, then scope and clocks.
• Two forensic tracks, one through counsel for litigation and one for remediation, protect the report that matters most.
• Screen before price, re-screen before payment, and write it down.
• The shortest applicable clock controls; build the deadline map on Day 1.
• Put the payment decision to the board with a memo and minutes.
• Payment does not change notification.
• Prepare for litigation before the first complaint is filed.

This document is general information, not legal advice for any particular situation; reporting rules in this area change quickly, and each incident's facts matter.

Related Documents

Related Articles

• Ransomware and the Payment Decision: OFAC Sanctions, Reporting Duties, Insurance, and Negotiating With Attackers: the legal analysis behind every step in this guide.
• Data Breach Response and Notification: The Fifty-State Patchwork, Regulators, and Litigation: the notification statutes and breach litigation in depth.
• Cybersecurity Regulation for Businesses: The FTC Safeguards Rule, NYDFS Part 500, SEC Cyber Disclosure, and State Laws: the regulatory programs that produce the short clocks.
• Export Controls and Economic Sanctions: The EAR, ITAR, and OFAC for Ordinary Businesses: sanctions screening fundamentals.
• Paid Vulnerability Disclosure and the Line Between Research and Extortion: when the demand comes without encryption.
• Attorney-Client Privilege and Work Product for Businesses: Upjohn, In-House Counsel, and the Common Interest: privilege doctrine for the forensic engagement.
• Authenticating Text Messages, Chats, and Social Media Evidence: Rules 901 and 902, Metadata, and Deepfake Challenges: collecting and authenticating text messages, chats, and social media evidence.

Related Guides

• Responding to a Data Breach: The First Seventy-Two Hours: the general breach playbook for incidents without ransomware.
• Placing and Tendering a D&O or Cyber Claim: A Practical Guide: notice, consent, and panel requirements.
• Pleading and Attacking Standing in Federal Court: A Practical Guide: the first motion in the class action.
• Reporting or Receiving a Security Vulnerability: A Practical Guide for Researchers and Companies: handling vulnerability reports before they become intrusions.
• Building a Cybersecurity Compliance Program That Satisfies Regulators: A Practical Guide: the program regulators examine afterward.
• Collecting and Authenticating Messaging and Social Media Evidence: A Practical Guide: collecting and authenticating text messages, chats, and social media evidence.

Related Checklists

• Ransomware Readiness and Response Checklist: A Practical Checklist: this guide's steps as check-off tasks, plus readiness items.
• Litigation Hold and Evidence Preservation Checklist: A Practical Checklist: preserving logs, images, and email.
• Vendor Cybersecurity Diligence Checklist: A Practical Checklist: contract terms that matter when a vendor is hit.
• Messaging and Social Media Evidence Checklist: A Practical Checklist: collecting and authenticating text messages, chats, and social media evidence.

Related Toolkits

• Ransomware Response Toolkit: Decision Memos, Sanctions Screening Records, and Notification Templates: the forms used in each step.
• Data Breach and Incident Response Toolkit: From Detection to Notification: general notification letters and incident logs.
• Class Action Defense Toolkit: From Complaint Through Settlement Approval: papers for the litigation that follows.
• Digital Message Evidence Toolkit: Collection Protocols, Authentication Declarations, and Rule 902 Certifications: collecting and authenticating text messages, chats, and social media evidence.