US law has criminal penalties for paying a ransom to a designated criminal terrorist organization or under treasury sanctions.
Most hacking groups don't fall under that. Some, sure.
Most hacking groups don't fall under that. Some, sure.