If they have evidence of it being changed undetect-ably, then they are deeper in or have someone that was on the inside...
*************
or, it was all being monitored from one of those sites that can watch a good portion of the world’s data traffic in real-time.