A posted ransomware allegation tied to an architecture firm shows how quickly attribution can outrun proof when the only visible artifact is an opaque incident hash.