The November 2020 ransomware attack began when a contractor mistakenly opened a malicious attachment, an audit found.