How do we know that this isn't the case here and said hacker went after those records as well? This all seems like an inside job and thus even offline backups

How do we know that this isn't the case here and said hacker went after those records as well? This all seems like an inside job and thus even offline backups are at risk if a disgruntled employee wanted to go after it.