How did the ransomware get in? A site where the site owner put off having updates done has been compromised with ransomware. This situation brings up a lot of questions. A Google search has not produced any answers. The server is on a university system where they lock things down pretty tight. 


Are there any stats on the ransomware infection rates for Drupal sites, esp. compared to other systems?
What is the most common part of a Drupal site to be the hole for a ransomware compromise, ie. specific module, Drupal core, login function,  Apache server function?
How did the ransomware get in?


The website most likely got hacked.


  What is the most likely reason for a Drupal site to be infected with
  ransomware?


1) Well, doing exactly what that site owner did, putting off security updates which will leave you vulnerable.

2) Leaving the front door open: Allowing scripts, javascript/jQuery or PHP to be executed by regular users.

3) Not using Secure Login


  For sites that are available via both HTTP and HTTPS, Secure Login
  module ensures that the user login and other forms are submitted
  securely via HTTPS, thus preventing passwords and other private user
  data from being transmitted in the clear. Secure Login module locks
  down not just the user/login page but also any page containing the
  user login block, and any other forms that you configure to be
  secured.




Hacked!


  This module does not and will not prevent your site from being 'hacked'.
  
  This module scans the currently installed Drupal, contributed modules
  and themes, re-downloads them and determines if they have been
  changed. Changes are marked clearly and if the diff module is
  installed then Hacked! will allow you to see the exact lines that have
  changed.


Your Drupal site got hacked. Now what?