One person said the removal could mean the firm has paid a ransom to the hacking group, which is of the most notorious in the world and is viewed as having strong links to Russia.