Total speculation, my guess is WastedLocker. It has been hitting all types of companies in the past few months. Have a friend who's company was hit recently. They were somehow were able to encrypt the backups.
My vote is something's being held for ransom like DNS or account access rather than traditional storage encryption. It's pretty impressive if storage encryption crossed so many network boundaries and affected so many diverse resource types - phones, chat, email, website, distributed app platform. What other central resource besides DNS would have such a broad impact?
And the list of best practices for ransomware attackers includes keeping a low profile for a an undisclosed timespan before sending demands so that the victim does not know how far back the last clean backup would be. Backups are an important tool when solving the attack, but they are not the solution.