Should be noted that a lot of companies have absolutely no idea what was actually stolen due to insufficient logging.

Talking to the threat actor usually means getting some of the required info for GDPR.