Yeah leaked data stays leaked. You can often find out what was leaked tho.

I imagine this looks a lot like what people in the cyber security sector do after a breach. Audit all the code, scan all the servers, monitor everything for several months. It’s a ton of work and very expensive, but there are people with lots of real-world experience unhacking systems.