So I’m a cybersec professional with primary focus on Cyber Intelligence – where I track some of these groups. It is a strange move that the U paid the ransom to not release data because others are right that they have to trust the criminals. However, you’d be surprised how business like some of these groups are. What we see researching these more organized groups is they asses business risk like any company does and it is not in their own best interest to release the data to the public because if they do, the word gets out and it makes other victims less inclined to pay to the ransom.
However, I’m also confident that there is no way the hackers actually deleted the data they stole and they can monetize it without releasing it publicly. They do that by using the data for other attacks. Whether to attack individuals directly, develop intelligence on them and track their careers to see if in the future they get a job somewhere they want to target, or send phishing emails and compromising their email and using that person’s email to send phishing emails to others who would be more likely to open an attachment or click a link from someone they know. So the hackers can still make a lot more money while still adhereing to their agreement to not release the data publicly.
Utah @ 
UCLA .
