Handling an extortion demand
Whether to engage with an attacker at all is a business decision made under legal constraints. A payment can create sanctions exposure if the recipient is connected to a person or group the federal government has designated, and that exposure does not depend on whether the company knew who was on the other end. Many insurers require their consent, and their own vetted negotiators, before anyone communicates with the threat actor. Paying does not reliably restore data or prevent its publication. The decision is usually documented with care, because regulators, auditors, or shareholders may examine it later, and some regulators expect to be told about a payment separately and quickly.
Bringing in law enforcement
Reporting to the FBI or to federal cybersecurity authorities is often worthwhile, and agents sometimes know a particular group's tactics or have decryption tools. For many private companies such a report is voluntary, although certain sectors carry their own mandatory reporting to federal agencies. A report can affect timing elsewhere, since some notice laws permit a delay when law enforcement requests one. What gets shared, and by whom, is worth agreeing on internally before the call. Logs, indicators of compromise, and ransom communications should be kept in their original form so they can be handed over without later disputes about what was altered.
How counsel fits into the first days
Counsel's role in cybersecurity incident response is less about keyboard work than about sequencing and record-keeping. We coordinate with the forensic firm, the insurer, and internal leadership so that containment, communications, and notice decisions are made in a defensible order. Whether forensic findings stay privileged depends on how the engagement is set up and what the report is used for, and courts have reached different results on similar facts. When a company calls us mid-incident, we usually start by confirming who has authority to decide, what has already been said to the attacker or anyone outside, and which reporting clocks may have started.
