The ransomware attack discovered in August occurred as early as May when a state employee mistakenly downloaded malicious software.