"But I'm pretty sure about what happened. I was in a meeting with a customer, and we saw (yes, I've got witness) all my files (from my ftp area) were renamed to .lock and a message stating the area was attacked and encrypted."
Interesting. I assume it's managed Windows hosting? Wouldn't really be A2's problem if not.