Once someone gets into a system these days, it is even possible for the attacker to plant malware into the system flash memory and/or remote lights out adapter, or even use root kits that hide themselves preboot.
I’m NOT suggesting that happened here. I am suggesting that after compromise, there are significant challenges ahead to restore everything to a baseline configuration. Even worse is that if you literally shutdown all of the systems, each may
need to be isolated from the rest of the network to make sure nothing is left behind that would recompromise systems without an external attack.
Other than "We have been diligently assessing each system to ascertain
the extent of compromise. For example, while the Logbook of The World®
server and related user data were unaffected, we have taken the
precautionary measure of keeping the service offline until we can ensure
the security and integrity of our networks."
When there is a hack like this, each system needs to be completely
vetted to make sure nothing of the hacker is left in, including the
route used to get in to start with. That can take a while, especially if
the attack is "unique", which this one most definitely was.