Log4J attack can inject SQL to copy and extract data without any knowledge from Jim and staff for well over a year +
Sort of like solar wilds but better.
More than likely AI bots by the thousands have been implemented to crack Q's trip/pass which randomly slam passwords. Very tedious but quick work (considering the variables (character length, special characters etc.)
Chances are when Q's trip went active in January is when they bots finally cracked it.
Once cracking it, they would have to isolate for every salt rotation to compare and contrast differences over time.
6 months of analysis and how it compares to the salt, one would be able to reverse engineer the hash.