The attackers here broke in and stole a DB copy, they may not have been able to tamper (e.g.: they had access to a backup of the DB but not the running copy) I

The attackers here broke in and stole a DB copy, they may not have been able to tamper (e.g.: they had access to a backup of the DB but not the running copy) It's probably still a good part of a "we're incompetent not malicious!" defense, if that is how they decide to handle things.