Good chance you’re right. There’s little advantage to publicizing a major breach otherwise.
In any case this sounds like stuff we called “competition-sensitive” and kept on the unclassified intranet. That would include ITAR as well.
It’s safe assume everything on unclassified defense contractor intranets in general, has been merchandised. This being true of the larger contractors for sure. The nature of the beast is that there’s one intranet for even a large corporation with multiple divisions, meaning any employee with an account has access to most anything if they know where to find it. (The classified networks are by necessity isolated from everything else)
This breach could be getting publicity to “sell” certain info planted within, or the DOD could be purposely building a case to take some action against the company involved.
most large corps have many networks, most firewalled off from each other and several removes from the outside world.
sensitive data in HR, new projects, financial data would be examples of where separate networks are used. Roles determine who gets access to which network and to which resources on a network. pretty sure its been like this for decades.
hackers do find ways to compromise firewalls and gain credentials some of which you probably can guess..