I believe attacks like this often include copying data and then deleting it from the victim's servers.

Although of course returning is a weird term in the sense that the attackers will almost certainly keep the data as well.