An IT expert can make it look like a hack is coming from anywhere. I don’t think this is much different that scammers spoofing phone numbers which appear to be in my area code.
But can they hack the log showing the download speed and change it?
Because that’s the issue. Downloading files onto a thumbdrive is done at a much faster speed than uploading them to a remote computer via the internet.
And that’s the point, the speed indicates it was a theft done by an insider with access, not a hacker.