Police shut more than 14,000 accounts on Mega, Tutanota and Protonmail

Essentially. Police or anyone could report an account for illegal activity which is against ToS for all three of the services. From there the service would need to be able to substantiate the claim and then shut down the account. I've seen a few cases of proton accounts getting shut down. Proton can't read emails but they can read headers and if you've posted illegal activity in public using your proton email address or if law enforcement/ someone reports you for using proton for illegal activity then proton will be able to review headers to determine if you're violating ToS. Like a few years ago i think someone was using proton for ransomware, and proton was able to match the headers with emails that had been posted in public, and acct got shut down.

Unfortunately can't find that specific case but that was one example I've seen

You don't hijack a .onion site. You pwn the server which hosts .onion site. Give you full access to site. You hijack .onion because its very secure

Seems like it. You can try https://web.archive.org/web/20240222164851/https://therecord.media/lockbit-ransomware-takedown-mega-tutanota-protonmail

or

https://archive.ph/?run=1&url=https%3A%2F%2Ftherecord.media%2Flockbit-ransomware-takedown-mega-tutanota-protonmail