How do you know their definition isn't only "received extortion letters" and "exfiltrate data" is fine as long as it didn't lead to the former?