If this is the work of a nation state attacker, as sophisticated attacks often are these days, this is a very likely possibility. We saw just recently the like

If this is the work of a nation state attacker, as sophisticated attacks often are these days, this is a very likely possibility. We saw just recently the likely Russian backed attack on a wide net of US companies and even government agencies. I doubt Macs are used often in US gov agencies but they are used in tech companies for example. That latest attack hit a lot of seemingly random US companies but if you want to destabilise and cause loss of trust it is a very effective strategy. I happen to know someone who works high up in one of the affected companies where the malware had been sitting on the server for a few months passively gathering information before the attack. They struck in the middle of the night local time and erased all the backups before they begun running ransomware across the entire corporate network. Thankfully the attack was caught within 10 minutes and they were able to recover fairly quickly once the dust settled, but they've got especially good security. Such an attack could have done far more damage to a company. And if, like me, your first thought was "you're seriously saying they have good security but no off-site backups?" Yeah, I know. I'd bet they have regular off-site backups now though...