Once it becomes mandatory to report that you've had data stolen, blackmailing you is a waste of time. Blackmailing you to keep quiet - you can't, because you've got a legal obligation to tell everyone.