The investigation into the cyber attack revealed the use of sophisticated tactics, including destructive attacks targeting ICS/SCADA systems, reminiscent of Sandworm's techniques. The legal battle challenges the insurance 'act of war' clause, as the attack involved the deployment of wiper malware similar to NotPetya, implicating supply chain vulnerabilities.