> The cron job canary was probably not a service that employees were uploading tonnes of company confidential material into, was it?

But they do to Slack and MS Teams. Also go mail services and other places.