There's still a lot of uncertainty about the extent of the attack on Acer. Not only did the REvil operation lockdown files, but they also clearly exfiltrated some portion of that data. Exfiltration before encryption is becoming increasingly popular because it gives victims two reasons to pony up the ransom: they need to both regain access to their files and attempt to prevent leaks of their data.

The part that's most disturbing about this incident, however, is the threat from the attackers that Acer could be the next SolarWinds. Encrypting files and exfiltrating data, even their source code, wouldn't allow them to perpetrate a SolarWinds-style supply chain attack. For that, they would need to have compromised Acer's build or update systems.

While that seems unlikely at this point, and is probably just a scare tactic to increase the odds of getting the ransom paid, the prospect of a multi-vector attack that involves encryption, exfiltration, and exploitation, is terrifying. It's a cyber attack hat trick.