Negotiating is futile. They can never prove beyond “trust me bro” that they deleted the data, nor that they kept it secret, so why would they actually follow up?

Whatever they have, if it is good they have already sold it to several interested parties under the table, and they will continue to do so. This is just an attempt to grift out a bit of extra cash.