I wonder why the say "appears to have had," is that an assumption or was it stated somewhere? Without an offline backup, it would indeed be a very serious problem, more than it already is.
I think the "offline" part is what is that "appears" to be, clearly they have backups somewhere, but maybe the attacker just missed to wipe some other "online" location.
I interpreted this as a vagueness related to the reporting accuracy, not the existence of a backup.
My reading is: "The agency would surely be panicking more than this if they didn't have an offline backup".