As aside, it's hard to believe this incident in particular didn't get full NSA attention.
(The only exception I know of is allowing illegally-obtained evidence in defense against defamation claims...IANAL.)
For example, if I break into your home and steal your safe, which contains evidence of fraud you're committing, then the cops catch me and seize the evidence of my crime, thus observing evidence of your crimes, the evidence they took from my case can be used against you.
In fact, if I'm talking to my cop friend and he tells me about the case against you and that they think there's evidence of your criminal activity in your safe, but they haven't obtained probable cause, I could break in, take the safe, and provide it to my friend and it still be admissible in court. Your defense would have to make a convincing argument that my cop friend asked or coordinated with me to commit the crime of breaking into your house/safe.
> files said to be related to [...] supplier details.
Supply chain attacks are the social equivalent of malware persistence. Now you know what parts they need, what vendors they source from, and maybe even for what products, so you've found a number of ways to get back in later.
OTOH, this isn't plain ransomware, it's exfiltration+ransomware. More and more bad actors ransom, and after being paid, sell anyway. Why pay if they're going to slap your other cheek regardless?