Paying the criminals wouldn't help here. First, there is no guarantee that they wouldn't release the data anyway, second, the data already got leaked - criminals who were responsible for it have access to it, third, they publicly posted the information they have access to it.
Instead, the proper solution is after verifying legitimacy of the leak to immediately (within 72 hours) notify supervisory authority and users about personal data breach according to Articles 33 and 34 of GDPR.
Instead, the proper solution is after verifying legitimacy of the leak to immediately (within 72 hours) notify supervisory authority and users about personal data breach according to Articles 33 and 34 of GDPR.