@GossiTheDog@cyberplace.social time has passed so I think I can share that now: I used to work for a small hosting provider and, between my hiring and my first day, their entire infra was compromised because their firewall failed open and they used one of weakest password possible for the SSH accessible root account...
Luckily the attacker only deployed a miner, but when asked what would've happened if it were a ransomware, my then superior answered "we would be out of business".