I was working (very recently, during the 5000+ companies that were hacked via some what I presume were zero day hacks) for an MSP. 600 GB of data were exfiltrat

I was working (very recently, during the 5000+ companies that were hacked via some what I presume were zero day hacks) for an MSP. 600 GB of data were exfiltrated from a law firm with several terabytes of storage of customer data kept due to data retention laws. They asked for almost a million USD. FBI got involved, everything was restored from backups (thankfully, a month loss of digitalized work, and absolutely nothing was given to the ransomware group. To your point, there are severe regulatory issues that have to be addressed due to the exfiltration. I no longer work for them, so I don't know the extent of their cost in 1. notifying affected clients and 2. providing credit protection coverage due to leaking of personal data.