pull down to refresh

What did they ask for?
Did they lose data or was it a ransom type attack?