As an IT systems admin I can tell you with the amount of evidence they showed today -- they are most likely fucked. Timestamps matching to purges from outside access along with visual evidence of individuals accessing the system -- it is only a matter of time.

If they gain access to the switches/ routing devices it's over. And even without, there is at least enough evidence to incur legal discovery.