It says the attack hit multiple sites simultaneously. A worker said that the ransomware came through on the computers around 2pm.

This doesn't sound like a spread by phishing or attachment.

How could such an attach be co-ordinated?

I can think of two possibilities:

1) The attack has been spreading over days or weeks with a trigger date for activation. 2) The ransomware has been distributed through the desktop update system.

Any other ideas?