If they had an inside actor, how do they even know their systems weren’t compromised? If their org was compromised, then by extension, their systems were compromised.

That’s just security protocol 101: If the system has been hacked, burn it all down and reinstall.