The Chief Financial Officer (CFO) of a Major Hospital System

The Chief Financial Officer (CFO) of a major hospital system has received a ransom letter that demands a large sum of cryptocurrency be transferred to an anonymous account. If the transfer does not take place within ten hours, the letter states that patient information will be released on the dark web. A partial listing of recent patients is included in the letter. This is the first indication that a breach took place. Which of the following steps should be done FIRST?

A) Review audit logs to determine the extent of the breach
B) Pay the hacker under the condition that all information is destroyed
C) Engage a counter-hacking team to retrieve the data
D) Notify the appropriate legal authorities and legal counsel