Probably an insider

A ransomware infection at an electricity provider in the city of Johannesburg, South Africa's biggest city and financial capital, has left some of its residents without power.
The ransomware infection impacted City Power -- a provider of pre-paid electric power for Johannesburg residents and local companies.
The malware encrypted the company's database, internal network, web apps, and official website.
City Power admitted to getting infected in a series of tweets the company posted on its official Twitter account.

There is no way to tell. 

Even a phishing virus in an e mail could have been clicked on purpose, the insider being in on the deal.  The frequency of these attacks will increase, and the only known technology to stop them is AppleID, what a surprise.