The nuclear response to compromise should be the standard business practice. It should be exceptional to deviate from it. If you assume that they only accessed

The nuclear response to compromise should be the standard business practice. It should be exceptional to deviate from it. If you assume that they only accessed what you can prove they accessed, you've left a hole for them to live in. It should require a quorum of people to say you DON'T need to do this. Of course, this is ideal world. I'm glad my group is afforded the time to implement features with no direct monetary or user benefit.