If they had an inside actor, how do they even know their systems weren’t compromised? If their org was compromised, then by extension, their systems were compromised.
That’s just security protocol 101: If the system has been hacked, burn it all down and reinstall.
The wording is important. They can say their systems weren’t compromised, sure, but the bigger news is that their org was infiltrated by a bad actor.
If they had an inside actor, how do they even know their systems weren’t compromised? If their org was compromised, then by extension, their systems were compromised.
That’s just security protocol 101: If the system has been hacked, burn it all down and reinstall.