I'm not saying this is morally right or anything, but the other reason is to cause the spyware company's current and potential clients to lose faith in their re

I'm not saying this is morally right or anything, but the other reason is to cause the spyware company's current and potential clients to lose faith in their reliability as a partner. It's one thing to pop one of these companies and dump their tooling -- they'll just get a new set of 0-days if that's part of their MO and keep selling the tools, maybe changing them a bit to evade AV detection if that's a concern. It is another thing entirely for their client list and the identities of their client's targets to get leaked. That's the sort of thing potential customers of these companies want to avoid at all costs. All that said, I think they could have achieved much the same effect by just dumping their client list and maybe quietly (and privately) notifying the victims.