"The company said it had made every effort to get the data back"...

Even if they do, I heard it could be possible nowadays for the crooks to have made a *copy* of all the data. Could someone more technologically au fait please confirm?