Well, it might be helpful in the current predicament. Going after the perp, without taking care of the vulnerabilities might make them take a real interest and get more data out. So make sure it’s all off the grid.
Make sure it’s also deleted from the Internet archive. From search engines and so on.
We got police scammed for a while because my streaming wife’s contact was in some obscure 15-year-old backup of her first website on the internet archive. Before we used a service for that stuff. It had been offline for a decade already, so nobody even thought about it.