"...not an isolated incident. Over the past two years, there have been many cases where smaller companies decided to shut down for good, lacking the funds to pay a ransom demand to get their data back or lacking the funds needed to rebuild their IT infrastructure."

https://www.zdnet.com/article/company-shuts-down-because-of-ransomware-leaves-300-without-jobs-just-before-holidays/

This is happening to dental practices and government entities. I have a whole file of notes about this because I'm planning an article about it.

The news reports aren't saying what the crooks are exploiting but one article I found said it had to do with password access to remote access ports that are there so that the customer or IT contractor can gain remote access. The contractors use weak passwords in order to coddle the customer.

However, there are huge attacks against all websites and servers right now although it gets intense between October and X-Mas.

In my feeds, it looks like municipal govs and hospitals are the hot targets. IMO, both have a long history of "lowest bidder" software development combined with -how do I say this tactfully?- ummm, non-security-minded staff.