If the ransom has already gone

We need the txid, time, payment rail, operator correspondence and internal access logs. An insurance file lives on that, not on a screenshot of a threat.

In parallel we preserve infrastructure: images, mail, journals. Otherwise counsel receives a money story without a breach story.

A venue hold can be possible. There is no guarantee. Time is usually weeks, not quarters.