How so? Presumably they use a different one for each payment, no? Otherwise, how could they tell who paid?
http://www.coindesk.com/cryptowall-325-million-bitcoin-ranso...
http://www.coindesk.com/cryptowall-325-million-bitcoin-ranso...