A named ransomware allegation, a 64-character hash, and no verification trail - enough to raise defensive urgency without proving a breach.