While the threat of publication is a risk, the data has already been breached and you are no longer compliant with the law.