Ugh

I hope you can get it all sorted out. Business ransomware and ransomware disguised as bank or police mails are such a spreading plague here that they are talked about in the local and National television news. And still people sometimes fall for it because of several reasons like curiosity and not knowing about ransomware.

Yeah this wasn't someone stupidly clicking something they shouldn't have (unless someone gave login details to a phishing site, still possible) but I've certainly tried to tell people what to watch out for.

Make sure to keep every machine quarantined and scorch them clean before letting them back onto the network. Otherwise you'll be doing the same again within 2 days.