Usually it will be because they were investigating something else, and either seized a hackers device, or gained access to a hackers servers. Device or servers

Usually it will be because they were investigating something else, and either seized a hackers device, or gained access to a hackers servers. Device or servers will then have evidence of the other things the hacker and thier associates have been doing. Sometimes criminals brag about things. Other times, the compromised infrastructure is used in other criminal activity that gets detected by the next victim, and the law enforcement agencies work thier way back.