A friend of a co-worker works for a contracting agency with services including incident response for data ransoms. He says their go-to tactic is to haggle with the ransomers to bring the ransom down to some fraction of what the customer paid them and then implying to the customer that they cracked the key.

That's what Garmin ended up doing. The group had sanctions, so they had to pay a British company.

https://www.theverge.com/2020/8/4/21353842/garmin-ransomware...

Assuming the security consultant and the ransom gang are even distinct people at all. IT Sec is such an incredibly shady industry.

Yes, though in the case I am most familiar with, making the payment was a big deal because the hackers were in a sanctioned nation, which makes sending payments there illegal. If I recall correctly they went through some intermediary but still made the ransom payment. Which goes against all of the annual import/export corpo training, but I guess they found a loophole.