Imagine you are the IT systems administrator of a large corporation. Coffee in hand, you sit down one morning and log in. You receive a message that there has been an intrusion into the corporate database, a large amount of sensitive data has been stolen, and your backup in the cloud has been compromised. BUT "U R Datta WilL B REstoReD" once you pay "BiTCoiNS U.S.$50,000" to the anonymous cyber-extortionists. If you refuse, your data will be sold or publicly released. You are instructed not to involve police. The amount demanded is short money, you notice. Better to pay and move forward than risk the potentially catastrophic consequences.

The value of the kidnapped data is immeasurable: trade secrets, client and customer information, personal financial information, compromising emails between top executives. The list goes on. You owe a duty to all of these stakeholders to protect the company's most sensitive information and to resolve this crisis with the least damage possible. Should you quietly pay the ransom and hope the extortionists return the company's crown jewels? Or should you take a hard line, call the authorities, and refuse to submit to cyber terrorist threats that may or may not be real, lest you become a compliant target for future extortions?

Originally published on NACDonline.org on March 10, 2015.