When I worked in Ransomware Recovery, we employed a few agents. Normally they'd be chosen by whichever legal firm was assigned.

I can only imagine any firm having chosen this vendor is going to sued heavily.