Attackers found a hole in the DMZ and were able to slip through into the internal network, accessing engineering workstations. While tracing sessions that overlapped with artifacts created on these workstations, the incident response team discovered that hacker tools collected earlier were suddenly gone.