I read somewhere that one of the firms handling the server was backing them up to the cloud. Pretty ridiculous.
Yeah - well if that happened and the hackers got that all bets are off and it very well could be out the in the Dark Web, Dark Net, Deep Web whatever the kids call it these days., The rough/bad/wildwest part of cyberville.
More than likely they tapped into these IT guys backup cycle and were getting weekly updates done for them.
People who attack IT have a great understanding of how IT is used as intended. Having a semi clueless System Admin can be like having some one do most of your work for you if you are trying to copy files and change permissions.
Wouldn't surprise me if the had some mail filter or cron job installed. Doesn't always need to be complicated especially with clueless system admins, which is what it appears HRC had.