Or they could have stolen a few backup tapes, then infected the network with malicious software and left bits of logs pointing wherever they want. It's unlikely

Or they could have stolen a few backup tapes, then infected the network with malicious software and left bits of logs pointing wherever they want. It's unlikely Sony has full network captures. So a line in a log file with an IP is likely to be taken as absolutely true.