Utility provider failed to detect Cl0p ransomware attack for nearly two years