Company said demands were made for $20mn to prevent public disclosure of stolen customer data