DID NOT PAY: Who do you notify? What incident response steps do you take? How transparent would you be?