> .. if siemens .. Is it malware incident? Some cryptolocker? Or is it exfiltration of IP?

The CIO clicked on a p0rn site?