If they are scared but want to continue the "business" then they are stuck between a rock and a hard place. Getting hacked is a nice "out" from their contracts without losing money to reimbursements. Remember, they won't be accepting as wide a clientele anymore, so presumably a fair bit of that money they wouldn't get back from re-signups. On the flip side, they now have extra money they can use for incentives to the clients they really want to sign back up.
So, I think there's a good case to be made that this is the best course of action, given they are scared but don't want to quit entirely (which seems clear). It isn't nearly as bad a hit to their reputation as just taking the money and running, so they don't have to hide their identities and rebuild new ones to start over in crime, and they don't lose nearly as much money, and they probably won't lose the clients they actually care about.
So, I think there's a good case to be made that this is the best course of action, given they are scared but don't want to quit entirely (which seems clear). It isn't nearly as bad a hit to their reputation as just taking the money and running, so they don't have to hide their identities and rebuild new ones to start over in crime, and they don't lose nearly as much money, and they probably won't lose the clients they actually care about.