Some details already published online after negotiations over ransomware attack on supplier ‘did not go well’