They have for sure connected their own servers to the network. One was misconfigured as an open relay an was used by spammers to spoof gov email addresses. The rest are sending data gods knows where or who has access while they're rewriting code in production.