Those are much rarer, and in several cases the attackers didn't actually have the data when those threats are made. That aside, what you're talking about is sub

Those are much rarer, and in several cases the attackers didn't actually have the data when those threats are made. That aside, what you're talking about is substantively different crime and one that is much easier to prosecute internationally than computer based crime. Espionage, and blackmail are both crimes that have been around for a very long time and have international treaties around them. That doesn't stop it from happening, but when someone is caught it's much more likely they're going to be extradited and prosecuted than for a crippling attack against a computer system. Either way, if an attacker is threatening to release your internal confidential data, would you rather have a copy of that data as well or not? Your course of action is also the same in either case, notify the FBI if you're in the US.