I think your intentions are in the right place but I don't think that would have helped here - they didn't just get in via SQL injection, they have all the sour

I think your intentions are in the right place but I don't think that would have helped here - they didn't just get in via SQL injection, they have all the source code too. That hints that they had quite a lot of access. Based on what we know about breaches in general, it's quite likely the attackers were inside the network undetected for months: https://blog.code42.com/the-heavy-cost-of-ignoring-dwell-time/ https://blog.code42.com/the-heavy-cost-of-ignoring-dwell-tim... This would be plenty of time to slowly spread through the network, learn what is stored where, and hop through servers until they got what they need - even in a setup like the one you describe.