If you believe Chris Krebs (lol) and the mainstream media, a group called DarkSide launched the attack. They are known to collect mass quantities of clear text data when they ransom someone, so they could’ve grabbed all kinds of interesting info from those business systems if it really was them.

One outlet called them DarkHorse, which makes me think they aren’t really the ones behind it but are being pushed as the perpetrators for cover purposes.