If they got in this far, what else did they get access to? How long have they had access? Saying its only a db *that they know of*. What about the software re

If they got in this far, what else did they get access to? How long have they had access? Saying its only a db *that they know of*. What about the software repositories that they host somewhere?? Did the admin have access to that? This is pretty major....