I always assume ransomware when they refuse to provide details and it's an extended "outage". Likely attempting to use FBI sources keys to decrypt the data and exhaust all other options before they finally state the scope of the problem.

Not how anyone should handle the incident... but that's how they chose to I guess?