Well Bercilak had said they received a "ransom demand from the attackers". So... no I won't require logs from Wireshark, the ability to know what they are OR the privilege required to observe... Just proof of there even being "attackers" in the first place. Is that not obvious?
You are seeing the proof. Servers are still up. Some people are connected. Everyone else disconnected and their requests to the server to connect will time out.
it is VERY common that MMO's or any type of online based game will get attacked like this. New companies trying to start up in this area are a prime target. They are missing years of trial and error in setting up defenses against it that don't effect legitimate customers.
Showing a copy of the ransom or logs of any kind does nothing but glorify, give attention and encourage the people behind the attack. Even them doing you all a solid and mentioning there is a ransom involved is negative as it gives attention to the attackers.