I cannot find the reference but I remember reading, not too long ago, that even the professional ransomware gangs can be extremely lazy with their own security. Apparently even some well-known players (not script kiddies) could be identified because they used their personal email address or something similar.