Similarly, the suspected or known loss or theft of explosives must be reported to the ATF within 24-hours of the discovery. This has, in my experience, resulted in some "oh no we totally know where that inventory mismatch is" incidents. Boy does their tune change when I make the report for them.

The context is ransomware, though. It would be pretty useless ransomware if they didn't tell you your data is being held ransom and where to make a payment. It's not exactly the kind of incident you can bury your head in the sand when 99% of the time you're proactively alerted to the issue.