"As ransomware attacks crippled businesses and law enforcement agencies, two U.S. data recovery firms claimed to offer an ethical way out. Instead, they typically paid the ransom and charged victims extra."

https://features.propublica.org/ransomware/ransomware-attack...

Always a risky answer, of course, especially from some random person on HN. But in this case, it makes sense, and a 'long arm', international treatment is a general solution for powerfull entities needing to break a law.

I don't think you'll find anyone going officially on record as breaking the law, however. Most companies won't even let it leak they're a victim.