A ransomware event is a legal event with a technical cause, and the decisions that determine a company's exposure are almost all made in the first three days by people who are not lawyers. This article follows a single fictional incident through the choices that matter: who is called first, how the forensic engagement is papered, when each of a dozen incompatible reporting clocks begins to run, and why the most dangerous document in the matter is the one the company paid a consultant to write. It explains the divergence among the fifty state notification statutes and the sectoral overlays that sit on top of them, including the HIPAA breach rule, the GLBA Safeguards Rule, the SEC's four-business-day Item 1.05 requirement, the banking agencies' 36-hour rule, and CIRCIA. It then covers the substantive standard of reasonable security under FTC Section 5 and state safeguards statutes, the sanctions analysis that governs any ransom payment, the supply-chain problem that produced most of the last decade's largest incidents, and the litigation that follows, including standing after TransUnion and the officer exposure that SolarWinds and the Sullivan prosecution put on the table. The through-line is that breach response is a documentation exercise conducted under adversarial conditions, and the record made in the first seventy-two hours is the record that will be litigated for the next five years.