Logins, personal information and tax info were all exfiltrated ahead of the ransomware attack, thanks to a phishing email.
Source: Threadpost