A named victim, a ransomware brand, and a 64-character hash are enough to trigger alarms - but not enough to prove a breach.