Is this due to the php vulnerability from a few weeks ago? Guessing they were on some php-based cms, and their staff never got around to fixing it in time.

▲

sheepjumpmoons 5 hours ago | parent [-]

Ransomware infections frequently start with a phished user, not a popped web app.

	▲	vinnymac 4 hours ago \| parent [-]
		Not to mention since a few weeks ago several other CVEs have dropped that would have been just as exploitable. Such as *sshole