Not multiquoting...
Thanks.
If they lost at least 12 hours, then that would be once a day backups. If 12 hour backup, it would be at most 12 hours lost.(actually 11:59, but I digress)
Sucks when it's foreign...way more difficult to trace and then prosecute (laws vary drastically)
As for how they got the password, there are several ways they could have
Admin ended up getting a keylogger on their computer
Admin had a "bad" password and system did not enforce lockout after X failed login attempts
Hacker was somehow able to get password database, which would give them however long they wanted to crack it
They executed a man in the middle attack, which can either provide them with the password or escalated (admin) privilege as well as the authorized user
There are others, but harder to explain