The IT department receives a call one morning about users being unable to access files on the network shared drives. An IT technician investigates and determines the files became encrypted at $12$:$00$ a$.$m$.$ While the files are being recovered from backups, one of the IT supervisors realizes the day is the birthday of a technician who was fired two months prior. Which of the following describes what MOST likely occurred?

a$.$

The fired technician installed ransomware on the file server.

b$.$

The fired technician installed a rootkit on all the affected users' computers.

c$.$

The fired technician placed a logic bomb.

d$.$

The fired technician left a network worm on an old work computer.