> I think the internet ban only happened after the fact. That's exactly GP's point - that part of the response was to ban internet usage indicates that employe

> I think the internet ban only happened after the fact. That's exactly GP's point - that part of the response was to ban internet usage indicates that employee internet usage was part of the attack vector. (i.e. that one computer was probably infected through social-engineering means)