A ransomware listing tied to Hal Otey Financial raises a familiar but high-stakes question: whether sensitive identity and financial records were actually taken, or only threatened as leverage.