So far, it's all "insiders suspect."
I doubt a FOIA request will contain details of classified information except to say, "Deleted for National Security Reasons" or something like that. But of course, if it says "something like that," it's pretty prima facie on the face of it :) .
I wonder if it wouldn't be better to go after Datto's records. I suspect, without knowing for a fact, that no data manager worth his or her salt leaves anything un-backed up somewhere else. Just as a backupbackup or even a backup backupbackup.
Which begs the question.... did Datto have a security clearance?
Gee, that past election cycle gets amusinger and amusinger every day !