A ransom demand involving company data: what does the first decision require?

Checked: 2026-10-12

The practical question

Files stop working and a payment demand appears. What is established: disruption, exfiltration, or only a threat?

Businesses facing a digital threat or possible disruption; duties differ by sector, data and facts.

Separate the sender’s claims from technical findings. A recorded threat does not prove the volume or authenticity of data held. An authorised incident lead and technical team should weigh service continuity and evidence preservation, recording changes and reasons. The tool does not issue operational commands that may destroy evidence or automatically recommend paying or negotiating. Reporting and notification requirements must be assessed by sector and data, rather than assigning one deadline to every business.

Alternative explanations

A technical failure coinciding with a false threat, an unsupported claim of data possession or misunderstood legitimate access restriction.

Legal basis and verification limits

Article 3(2) concerns unlawful access for threats or extortion, while Article 5 addresses specified harm to data and systems under the Anti-Cyber Crime Law. The proved conduct determines the possible provision; describing an incident as ransomware does not establish every element.

• نظام مكافحة جرائم المعلوماتية: https://www.mof.gov.sa/docslibrary/RegulationsInstructions/DocLib/نظام%20مكافحة%20جرائم%20المعلوماتية.pdf

Review questions

• Which systems are affected, and what evidence indicates data left them?
• Is harm ongoing, and who is authorised to lead the response?
• Does the sector or data require assessment of specific duties?

Relevant records

• Demand message, time and channel
• System logs, alerts and access records
• Backup assessment and response-action log

Hypothetical example

Hypothetical example: a sender claims to hold an entire database but shows an image previously available online. Independent technical evidence is needed; the image alone neither establishes nor excludes a breach.

A proposed preventive control

Does the business know who leads incident response, how restoration is tested and how actions are recorded?

Questionnaire options: Yes, Partly, No, Unknown, Not applicable. Unknown triggers verification; Not applicable needs an applicability reason. Neither is treated as a missing control.

When professional help is useful

To request a paid legal consultation, begin with a brief non-confidential description. Identifying the parties, checking conflicts and agreeing scope and fees come before work. The consultation includes an initial review of documents within an agreed scope, a meeting to discuss the facts and questions, and a concise written summary of options, missing information and the next step in the agreed language. Internal investigations, settlement, complaints and representation are separate engagements when needed. Company representation and individual defence are separate paths subject to position and conflicts.

References

• نظام مكافحة جرائم المعلوماتية: https://www.mof.gov.sa/docslibrary/RegulationsInstructions/DocLib/نظام%20مكافحة%20جرائم%20المعلوماتية.pdf

Related legal service · Existing tool