What a rebuild asks of the disksEach surviving member of the set is read from the beginning through to the end, and parity is written back as it goes along. For a set that has already lost one disk, this is likely the toughest read that any one of them has had to endure in years, and it happens at exactly the wrong time.
Where a NAS keeps itNot in the box. Each disk has a superblock containing the details of how it was configured into the volume. So if an enclosure fails to start up, that is rarely the end of it: the disks are removed from the failed enclosure, and the volume is recreated from them here.
Water, heat and the mainsA broken pipe above a comms cupboard is the least dangerous type of damage. Heat comes next (solder or plastics will give out before the alloy body of the disk does), and then the board is just another part to buy in. Then power. When the power is turned back on after being off for a while it can come back hard. Since all the disks get their power from the same supply line, a surge through that line passes to each disk on it.
After a ransomware incidentEncryption happens fast enough to be careless. There may still be a snapshot inside the box, shadow copies nothing got to, files that were deleted instead of overwritten, large files encrypted only in pieces, and a list of files is built from those pieces. No ransom is paid, and no contact or communication is initiated.