If this comes to ransom, rather than unethical/unexperienced gray hat thing, are there any good steps to take? Or hiring an expert consultancy is probably the only good option here?
I assume a professional computer security firm could help, but I don't know enough about the incentives at play to know whether that's good in practice (if they often deal with situations like this and not just hardening/forensics, I assume they would have good advice). I have no idea what that costs, and whether your business can afford it.
By sending just the proof he forces you to reconsider your approach to security and start from clean state.
I'm not saying you should or shouldn't, but several comments have suggested contacting this person; it's not clear that that's even possible.