Failing to return your victims' data doesn't just poison the well for other, more sensible ransomware makers -- it poisons it for you. Once you take the first guy's money and leave him with his files destroyed, why would the second guy pay you?

Which tells me the other solution is for victims to say it didn't work, even after they paid those assholes.

Enough victims will come forward and contradict you. Or the creators of the ransomware could plant false reviews.

Wow. Seriously, that is just stupid on their part (the victims).

>why would the second guy pay you?

Because the second guy can either guarantee himself to be screwed or pay some nominal amount below his pain threshhold to at least have a chance of recovering his files.

I wonder if they are really worried about the second person, or are more concerned about losing repeat business with their first "customer"?

They're worried about the second person. No one is going to make a habit of contracting and then paying off ransomware.

I doubt the crypto code takes more than a day, eh? Generate random data encryption key key. Encrypt with master public key. Done?