How did the ransomware get in?
The website most likely got hacked.
What is the most likely reason for a Drupal site to be infected with
1) Well, doing exactly what that site owner did, putting off security updates which will leave you vulnerable.
3) Not using Secure Login
For sites that are available via both HTTP and HTTPS, Secure Login
module ensures that the user login and other forms are submitted
securely via HTTPS, thus preventing passwords and other private user
data from being transmitted in the clear. Secure Login module locks
down not just the user/login page but also any page containing the
user login block, and any other forms that you configure to be
This module does not and will not prevent your site from being 'hacked'.
This module scans the currently installed Drupal, contributed modules
and themes, re-downloads them and determines if they have been
changed. Changes are marked clearly and if the diff module is
installed then Hacked! will allow you to see the exact lines that have