By the time they realized the problem, their backup was also compromised (the nulled code had been there for months).