They outsourced some IT staff. Reports are that this attack hit the epidemiology department, which lists a 10-person IT staff: https://epibiostat.ucsf.edu/our-team
I don't think we can assume that the IT outsourcing directly affected their vulnerability to this attack.
And reading the poor spelling and grammar in the negotiations makes me wonder if that’s somehow related.