The model I'm used to is, you pay the ransom. Based on my experience and knowledge, ransom is paid and they facilitate the best practices moving forward.
2019 ProPublica interview
“The recovered logs record successful exploitation, including verification of root access by executing the id command through the installed webshell.”
“We recovered a custom PHP2Shell implementation tailored to the targeted firewall platform, version-specific profiles, exploitation logs and post-exploitation scripts”
“cyber shockwave ripping through our industrial heartlands”