AT&T reportedly negotiated through an intermediary, called Reddington, acting on behalf of a member of the ShinyHunters hacking group. The hacker originally asked for $1 million before AT&T talked them down to the amount, which it paid on May 17th in bitcoin, Wired writes.

The outlet reports that Reddington, whom AT&T paid for his part in negotiations, said he believes the only complete copy of the data had been deleted after AT&T paid the ransom, but that it’s possible excerpts are still in the wild. Reddington also reportedly said he negotiated with several other companies for the hackers, too.

Before AT&T announced the breach, it was reported that Ticketmaster and Santander Bank were also compromised, via the stolen login credentials of an employee of third-party cloud storage company Snowflake. Wired reports that, after the Ticketmaster attack, hackers used a script to hack potentially more than 160 companies simultaneously.