For the sf-86 data it really should have been stored on an air gapped network, encrypted, with physical security. That type of data is far too valuable to leave connected to a publicly accessible network in any way.