The hackers allegedly offered the data on the dark web for $3.5 million. Here are the lessons learned.