This absolutely doesn’t surprise me and I wouldn’t be surprised if it didn’t happen more often than not.
I’ve worked with insurance companies that have these IT contractors who are so high on their horse touting how many negotiations they’ve done and portraying themselves as people with experience with ‘such and such gang’ and they’re so full of shit because they don’t know squat when someone who actually knows squat is listening to them, and how they ‘negotiate’ is they give a large amount of money they can squeeze out of insurance to the hackers to get the decryption keys.
I’ve seen the transcripts of how one popular company goes about their business and they literally start out with a high number saying, “we’re willing to pay this much if you give us the decryption key within 12 hours” and there’s no real negotiation. I’ve often said, ‘man, it almost seems like the negotiator is in on it.’