> The worst case for us is that someone does break in and doesn't tell us how they did it.

I do hope you're logging all incoming data to a backup server somewhere, so you can analyze it afterwards if this were to happen.