Post-breach 
recovery center

Yes — engaging cyber law counsel early is one of the most important steps a company can take after a reportable breach, for a few reasons:

• Privilege protection: Counsel can direct the forensic investigation under attorney-client privilege and work product protections, which can materially affect what becomes discoverable if litigation follows.
• Notification compliance: Cyber law attorneys stay current on the patchwork of state notification deadlines, thresholds, and content requirements (which change frequently — several states have updated their laws in just the past year), reducing the risk of a compliance misstep that itself becomes a liability.
• Litigation exposure: As outlined elsewhere in this FAQ, plaintiff firms often move quickly once a breach appears on a state registry. Having breach coaching counsel in place before that happens puts you in a stronger position to respond rather than react.
• Regulatory coordination: Counsel can help coordinate communications with state attorneys general, HIPAA (if applicable), and other regulators, so the company speaks with one consistent voice.

Even if your company already has general counsel or an outside law firm, that firm may not have deep cyber incident response experience — this is a specialized practice area. CRI's Post Breach Recovery Center can connect you with cyber law attorneys and incident response vendors through our referral network to help you get breach coaching in place quickly.

This is one of the most consequential decisions a company faces during a ransomware incident, and there is no universal right answer — it depends heavily on the specific circumstances. That said, here are the key considerations most companies weigh:

Reasons companies hesitate to pay:

• No guarantee: Paying does not guarantee you'll receive a working decryption key, that exfiltrated data will actually be deleted, or that the same actor won't target you again.
• Sanctions risk: The U.S. Treasury's Office of Foreign Assets Control (OFAC) has warned that paying ransoms to certain sanctioned actors or jurisdictions can itself violate federal law, regardless of whether the payer knew the recipient was sanctioned. This is why sanctions screening before any payment is critical.
• Funding future attacks: Payments can incentivize further attacks against your company or others.
• Some states and insurers are increasingly scrutinizing or restricting ransom payments.

Reasons companies sometimes decide to pay:

• Business continuity — if systems are down and backups are unavailable or also compromised, the cost of prolonged downtime may exceed the ransom.
• To attempt to prevent stolen data from being leaked or sold, in a data-exfiltration ("double extortion") scenario.

What we recommend before deciding:

• Engage breach counsel and a qualified ransomware negotiation firm immediately — do not negotiate or communicate with the threat actor directly.
• Have counsel and your negotiator run sanctions/OFAC screening on the threat actor before any payment is considered.
• Loop in law enforcement (FBI/CISA) early; this doesn't preclude other options but can provide useful intelligence and, in some cases, decryption assistance.
• Check your cyber insurance policy — many policies have specific requirements about consent, approved vendors, and notice before a ransom payment will be covered.
• Assess whether reliable backups exist as an alternative recovery path.

Ultimately, this decision should be made jointly by legal counsel, your incident response team, and often your cyber insurer — not unilaterally by IT or leadership under time pressure.

For most companies handling any volume of personal data, cyber insurance is worth serious consideration — a single breach can trigger costs across forensics, legal counsel, notification, credit monitoring, regulatory fines, and litigation defense that add up quickly, often before any liability is even determined.

What cyber insurance typically covers:

• First-party costs — expenses your company incurs directly, such as:
  • Forensic investigation and incident response
  • Legal counsel (breach coaching)
  • Notification costs (mailing, call centers, credit monitoring for affected individuals)
  • Business interruption / lost income from system downtime
  • Ransom payments and negotiation costs (subject to policy terms and sanctions compliance)
  • Data restoration costs
  • Crisis PR/communications
• Third-party liability costs — costs from claims by others, such as:
  • Litigation defense and settlements from affected individuals or businesses
  • Regulatory fines and penalties (where insurable under state law — this varies)
  • Payment card industry (PCI) fines and assessments if payment data is involved

Key things to evaluate when choosing a policy:

• Panel counsel and vendor requirements — many policies require you to use insurer-approved law firms and forensic vendors, which can limit your ability to use CRI's referral network or your own preferred providers. Check this before a breach happens, not after.
• Sub-limits — some policies cap specific categories (e.g., ransom payments, notification costs) well below the overall policy limit.
• Retroactive date — whether the policy covers breaches that occurred before the policy was purchased but discovered after.
• War exclusion / nation-state exclusions — increasingly relevant given nation-state-linked ransomware groups; some carriers have tightened these exclusions.
• Consent requirements — many policies require insurer consent before you pay a ransom or settle a claim, which can slow down time-sensitive decisions.

A note on timing: Insurance needs to be in place before an incident — it cannot be purchased retroactively once a breach is known or suspected. This makes it a "before you need it" decision rather than something to consider once you're already on a state breach list.

We are not insurance brokers or advisors, so the right coverage type and limits depend on your company's size, data volume, and risk profile — we'd recommend discussing specifics with a broker experienced in cyber policies, potentially through CRI's network of Cyber Risk Advisory providers.