Somebody looked at the population of people who wanted to run ransomware, decided it was larger than the population who could, and built a product for the difference.
A leak-site count is a measure of publication, not of income. This is the first case where both can be looked at side by side.