As people are pointing out in the replies there are very good reasons to be suspicious of this story.
The sheer size of data. The bandwidth required. The orchestration and logistics.
How does one even verify 10PiB of data? Samples were provided by the attackers apparently, how do we know they reflect the rest of the data in the set? How do we know it's not mostly filler slop?
🧵/end