Certainly not 100% of cases but very common:

"As ransomware attacks crippled businesses and law enforcement agencies, two U.S. data recovery firms claimed to offer an ethical way out. Instead, they typically paid the ransom and charged victims extra."

https://features.propublica.org/ransomware/ransomware-attack...