“As part of that agreement, the data was returned to us, we received assurances that it will not be further shared on the dark web or elsewhere.”