"it seems like all usual controls were bypassed". Apparently it isn't known. Let's answer this question and be impartial about it. A story about China having access to Treasury Department workstations landed a few months ago. There may be a LOT of bad practices in place. We should be pushing to improve them if so.