Who was behind the recent NotPetya hack?
Some of the facts:
The hack was first spread via a Ukrainian accounting software, which is only one of two options that Ukrainian companies are permitted to use by law to do taxes (source: https://medium.com/@thegrugq/pnyetya-yet-another-ransomware-outbreak-59afd1ee89d4). This hits anyone with official business interests in Ukraine hardest.
The hack had an email address for correspondence, shut down very quickly by the email host. Why didn't the hackers use some sort of decentralised communication tool that could not be shut down so easily, if they ever intended to help users reclaim their data?
Further analysis by security research suggests that there is no way to reclaim the data (source: https://securelist.com/expetrpetyanotpetya-is-a-wiper-not-ransomware/78902/), the recovery ID is just random data.