The attack quickly encrypted 158 workstations – and would have been worse had it struck later in the working day.