Case: When Hackers Turn to Blackmail & CareGroup Question #4

Does the reason a network fails change the nature of the response? For example, in what ways is Sunnylake’s response helped or hindered by receiving a ransom notice? Do you think CareGroup would have reaction differently if they had coincidently received a threatening message?