I think it's pretty difficult to meet the "known or should have known" threshold for that kind of thing.

The proxy company can always say they are using their super crypto cracking skills to reverse the encryption. The hacked company would have no way to know they were paying the hackers, nor any way to find out.

Obviously the proxy company is breaking the law, but they might be in some untouchable jurisdiction.

Especially if the entire communication goes over the internet via an obscure channel.