Comment by SpicyLemonZest

It sounds to me like there's some application-level logging on this NxGen system, and DOGE obtained permissions to read the underlying storage without going through the application. But the article does also say later on that there are specific controls and monitoring systems Berulis did find turned off.