Curious if the affected party had a plan for this situation at beforehand.

I have stopped relying on instances being secure and map out a just-in-case strategy (that I also regularly oversee or exercise) to quickly reset/restore and get back on track.