Comment by alexfoo

And if the company doesn’t pay it they would therefore have to go through with their threat to publish it.

More than likely they will just claim that the company paid the ransom and never release the code (or at least not immediately).