If your database system doesn't have a complete audit log of all fields (most databases have this capability, but more often than not it's disabled), it's possible that the mere act of reverting account ownership might remove data needed for tracing down what happened.

Sure, it's a sucky position to be in, but I can see why they might have been hesitant to dive right in and start trying to undo damage before understanding what had happened.

> I can see why they might have been hesitant to dive right in and start trying

I mean, after all - it was only the cattle.

It's not as if the attackers got into the accounts of customers, the paying advertisers.

(Besides, the Part Time CEO was probably in Africa and unavailable to provide decisive direction, right?)

Which databases? It's definitely not standard in PostgreSQL or MySQL/MariaDB

Replication logs (WAL logs in postgres) contain a complete list of changes to every field. Most big companies keep them as part of a backup strategy. But most wouldn't have the tooling to inspect the logs and see exactly which change was made when during an incident.