The question, as currently worded, is most definitely a legal issue. Even if it were not, it falls very close to being close-worthy as "too broad" or "primarily opinion-based" anyway. So, it's probably better that it got migrated than just shut down.
Here, you have a security incident where a certain amount of impact has been assessed. (In this case, some files being encrypted by unauthorized code running on the system.) It is very possible, perhaps even likely, that the incident's actual impact is greater than what has been assessed - and, depending on the resources available to the assessors, greater than what can be assessed in the absence of a public disclosure from the attackers or their clients. (In this case, the files could possibly have be exfiltrated and the affected organizations may not have the logging/monitoring tools needed to recognize this.)
If you had asked how the security team should react, in terms of recovery & reconstitution, mitigating the vulnerabilities that were exploited to cause the scenario, or restoring the system to a secure state, then it would be closer to on-topic for IT Security. It's still a bit subjective as to whether or not it would be appropriate, in any given situation, to treat the incident as if it had higher impact than what can actually be seen. But at least it would be more on-topic.
Instead, your question is about how the security team is or should be required to report this. And that is very much a legal matter, subject to corporate policies and local laws. You're even specifically citing references to U.S. federal and California state laws. While security experts may often conduct work affected by these, and are frequently even called to testify regarding them, the best people to offer reliable advice on any subject pertaining to law are experienced lawyers. Always. Without exception.
Let's generalize this a bit, to another possible scenario. Instead of having files encrypted, let's say the system just started to suddenly get ads for porn or gambling sites popping up on its screen randomly. There's obviously something unauthorized running on the system, and (absent certain monitoring/logging capabilities) we can't really be sure what else it might be doing.
A question like this might be acceptable here: "I got infected with some malware that did ABC. Antivirus detected it as XYZ. I think I got it all out, since the bad behavior stopped and I don't see file foobar.exe or any registry entries with bazquxnorf in them anymore. Should I return the system to production, or are there other measures I should take to lock it down and ensure it is clean?"
It would be a fair bit subjective, and most likely get a bunch of responses like "nuke from orbit", "uninstall Java", "upgrade to Linux", etc. But it would be a bit more on-topic.
However, your question is more like: "I got infected with some malware that did ABC. I wiped the machine and rebuilt it from a known-good image. Should I report this to legal?"
Even if that didn't get migrated to Law.SE, answers around here would be more like "it depends on [long list of factors that we don't know the answer to]", or "you need to check your company's policy", etc. So, it would still end up closed here as too broad or primarily opinion-based.