It was 2:14 AM when the first alert chimed. Someone had breached the company's legacy FTP server, a relic