Reply to post:

an analysis of the ransomware code suggests it doesn't steal data for later ransom, but instead simply locks it

And analysis will not have any clue if the crew exfiltrated anything before encrypting files. I know I would.