This is not speculations. The hacker has removed all my database and is demaning money in bitcoin. The website does not even have a domain yet. I dont have anything to lose if you dont trust me on this. I am just warning people. Thats it.
I am sorry about what happened to you but you are not providing any helpful information.
If you are trying to warn people, you need to provide specifics.
I am not trying to be critical here but from your description of your situation, it doesn't even look like ransomware. I don't think ransomware specifically removes your "local databases". I might be wrong though ...
Also if ransomware removed your data, there would be nothing to ask ransom for! so there is that.
without pinpointing the malicious file, your attack could have come from anywhere.
I am genuinely curious to learn more about this and I am not dismissing you in any way. But if you believe there is malicious code in the template, you need to provide some information that we can count on.