It's moderately likely the employee in fact deleted that copy and the "disappeared seconds before it happened" is a fig leaf or polite fiction. Have to assume

It's moderately likely the employee in fact deleted that copy and the "disappeared seconds before it happened" is a fig leaf or polite fiction. Have to assume the data were compromised anyway, as you point out.