Most stolen data is very hard to sell for meaningful amounts. Such an “exit scam” would be a waste of time, you’d make more money by just ransoming one more company.

When you’re earning (tens of) millions by extorting companies you aren’t going to be very interested in selling their data for tens or hundreds of thousands.

True, it's probably not worth the time unless they've stolen some very valuable data. Obviously things like plastic surgery pics wouldn't be worth much of anything.

Depends on the clients. I remember a case where a family that hid their daughter's cosmetic surgeries had the marriage annulled when it was discovered by the groom's much wealthier family.

So a lucrative target might be someone who traveled from outside the US to have work done to hide it, especially if they were relatively young.

It’s always possible to come up with an extremely unlikely scenario where the data would he be extraordinarily valuable, but nobody is going to bet hundreds of thousands (or millions, to actually make it worth it for the ransomware gang) to buy the data.

Exception would likely be pictures of celebrities. Their managers would not want those being distributed and would sue whoever they could.

Again, that’s only good for extortion. Only worth tens of thousands if you’re going to sell them.

Agreed. Otherwise they would just be dumped on the web or put behind paywalls of dodgy sites.