The "Statement of Work" contract, signed on Jan. 17, tasks the IT company with containing "networks, workstation and servers" while also assessing "how the attacker got in, which machines were ...