This could be even some malcious browser extension running on one highly privileged employee computer. Security is arms race and tradeoffs game, even computers never connected to the Internet are at risk (see Stuxnet story)