A public extortion claim can trigger real business risk long before investigators confirm whether files were encrypted, data were taken, or systems were touched.