There was a lot of news about a group called the Shinyhunters that hacked into a popular platform called Canvas that many schools use to keep track of exams and students records. With all this compromised data, not surprisingly the group is using it as a way to extort money out of various organizations where if they don’t pay up then they will release the data publicly.
That makes you wonder in these situations where if you were the business would you actually negotiate with these people to prevent a potential disaster? Or instead, would you notify everyone and offer some kind of compensation such identity theft protection for a few years because of this? In some ways, I think just offering compensation to the users may be better as there is no guarantee the hackers will honor any agreement.
I have seen some examples where companies literally write affected users a cheque in hopes that will e good enough. People do say never negotiate with terrorists as an example too.