Why don't someone pretend to be ransom hacker, take the money, and release the hacked data anyway?

This will progress the game theory to the point where nobody will pay ransom because the thieves won't honor the deals anyway.