Comment by andruschakartem

The ransom note was addressed to their DPO, customers just got CC'd via push.