I have my doubts the people arrested so far are the actual perpetrators. In fact the more 16 year olds arrested, the less likely it is. Quite aside from Finks Fifth Law, I refuse to believe 4 16 year olds could organise their homework diaries, let alone a "sophisticated cyber attack" (c).
Given how all this has played out, it's entirely possible the entire reason for the hack was to create enough media noise such that phone and email phishing attempts briefly became easier with no actual need to use the accessed data (and thus risk capture).
When news of a "ransom" was mentioned, I turned my thoughts as to how to extract money from such a situation without ever being caught. Obviously a straight transaction of bitcoin is ultimately identifiable. However, then I wondered, what if the perpetrator legitimately accumulated a stash of bitcoins over time. Undertakes hack. Ransom demand is that the victim simply buys £1,000,000 of bitcoins. I'm not economist, but the spike in demand should heft the value of my *already bought* bitcoins enough that I make a profit. Not the £1,000,000 paid out, but a substantial amount.