Suspicious logins reported after ransomware attack on US govt contractor