To my understanding, they demanded ransom a couple of days after the initial breach and not leaked anything yet.

Granted that their motivations are purely financial, they would try to sell first. And if it's not worth anything, they'd release it then.