The attack on the Doncaster-based insurance company was just a few days after the Colonial Pipeline’s initial compromise on May 7 and one day before the ransomware gang claimed to be shutting up shop.