I laughed at this part: "Damage assessment could take months."
The unstated assumption is that they actually have the ability to assess the damage.
They will never truly know what information silently flowed out the door while they were completely unaware.
This was allowed to happen by the bureaucrats we're supposed to believe have massive competence to run things. Credentialed technocrats who work for the government are supposed to be more competent than the rubes in flyover country.
They're not. Small business owners live with the real-world consequences of their failures. Government bureaucrats pay no personal price for their failures. Often they're promoted.