Ransomware rises a few complex questions - When a company pays a Ransom - Shouldn't it start the breach notification process (as the crooks have our data)? OR Should it wait for the cyber-crooks to expose our data or, what happens if there is a recurring demand for ransom?. I guess, "Prevention is better than cure" makes sense here.

https://hotforsecurity.bitdefender.com/blog/california-it-service-provider-pays-ransom-to-escape-sodinokibis-stronghold-21976.html