Yes. The hacker has a contact email where you can send queries using the CPF (unique for each Brazilian) of whoever you want. He'll then send you a bitcoin address for payment and send you back the info.
It would be pretty short-sighted to reward such an individual.
Would it? Hacking on the internet is pretty much immune to conventional systems that keep people honest, like being able to be caught and prosecuted or social norms. I think it's more useful to see hackers as like a force of nature to defend against but which it's useless to try to do any moralizing about. The more hacking that happens, the more secure computers will (hopefully) be made in defense, and the less vulnerable to future hacks. Hopefully it's not an endless arms race and eventually we figure out standard ways to keep things secure as a result.
I’ve already had to reward the government and credit bureaus to get access to my data. I don’t see anything too different about rewarding this hacker just because the law doesn’t bless this sort of data extortion like it does the rest.