What are your service providers doing on your infrastructure? Does their ISO 27001 cert let you sleep like a drunk baby at night? Go and audit the last 10 changes they made. Check permissions on file shares. Review group membership and privielges. Ask them to do some test restores. I wish you well.