The non-bank lender discovered a ransomware attack nearly one year ago, but only recently completed its investigation.