Other companies may opt for a more defensive strategy. If a company's network is compromised, some have chosen to instead seed fake data on their systems. Malware that periodically collects database information would suck up the bogus data.
"The bad guys are not really good at keeping backups of the original data," Holden said. In one case, Holden said "we were able to taint the data that was being stolen."
Cybercriminals are also in competition with one another. There have been instances of one hacker ratting out another to Holden's analysts in an attempt to shut down their competitor.
"There is no kinship between certain thieves," he said.
Sign up for CIO Asia eNewsletters.