Just because they are doing a side job, doesn’t mean they are giving away the store.
You have a network of computer with sensitive information connected to the internet. It was never intended to be connected to the internet. So it not even hardened to be connected to the internet. My guess is that any good hacker could have Gotten right in through the front door.