It's discouraging that so many companies don't back up their data.
I do understand the need for network access but I'd never rely on the authentication frameworks (of any database server) to handle this. Limited network access or a front-end API (itself with limited access). Never expose your data source if you don't have to.
They say the victims are buying their data back to prevent it being sold to a third-party.
"Once they’re in the database, they steal the data, send it to their own servers and then delete it from the local machines," Harpaz continued. "The victim has to pay a ransom for the data to be returned."
Elsewhere in the article:
"Once hackers manage to steal the data, it is posted on a website and sold to the highest bidder unless the victim agrees to pay a ransom of roughly $500."
I conclude that we're both right :)
They delete "from the local machines" which I interpret to be the victim's server. If the victims had had data backups, as simple as a daily cron task that calls mysqldump, presumably they would be unconcerned about restoring their data. However, they would still worry about their data being sold.
Since there's zero guarantee that the thieves will take down the data for the $500 fee, it seems pointless to pay them. They could come back in a month and say "you owe us another $500". Or just go ahead and sell the data anyway.