No one is clean in this mess.
The ISPs had full knowledge of what was happening. They can play dumb all they want but once they accepted money from NebuAD, they became full participants. If they did not know what was going on, then all those involved should be fired from their positions for not doing their jobs.
Once you collect money from a company that wants access to your customer data, then you are most certainly a part of situation.