I'm also dealing with my first one right now. Mine isn't anonymous and is following responsible disclosure - telling us first and giving us a chance to fix it before shouting it to the world / selling the specific info on bad-place forums.
We also don't have an official bounty program but I'm more than happy to make a one-off payment. The report contained some things that are trivial and we aren't going to fix, and some that are more interesting that we will. The way I see it I'd rather know about this stuff than not, because the bad actors are certainly running the same sort of scans on my systems and aren't going to be inclined to tell me about it.
I see the word 'extortion' being thrown about here and to me, the difference is whether they disclose the actual vulnerability found to you or not. There's a lot of difference between;
Hi there, I found XX and YY on your systems. Here's a report about what I found. It would be great if you could pay a bounty on what I found.
and
I found a vulnerability in your system, but will only tell you what it is if you pay me.
One of those I will engage with, one I will ignore or call the police. From the sounds of your question you are dealing with the first and they have told you what they have found. The anonymous bit is probably just covering their arse in case they did do something ... less than legal in order to find the vuln.
My advice would be to engage, fix the bug then have a conversation with your management about how much to pay.
About paying - I would recommend you require the finder to submit an invoice and you pay it in the normal way your company does - probably by bank transfer. That way you have the correct records for your finance department and it does not look like there's anything shady going on. I would strongly recommend you don't pay by untraceable money - crypto currency or cash services like Western Union. Those systems are used a lot by money launderers.
This does mean that the finder will need to de-anonymise themselves at this point, but it is better for your financial records to be correct. You should probably offer assurances that whatever it was they did to find the vuln will be ignored, but you need to pay them above the table.
Is there any good information online on how to estimate a good bounty?
A cursory Google search for estimating bug bounty payout brought up several different sites and calculators for me, all pretty much leading to the same conclusions. You should probably read them before the chat with management about the amount.
There is also this question; while being closed as off-topic, the accepted answer seems to summarise all the other sites I found fairly well and I consider it a good introduction to the subject.
