After post-mortem analysis; it turns out that there never was an actual security breach.
So what was wrong? Reasons aside, it turned out that we had wrong security descriptors assigned to a directory containing Token Pools (used for off-the-chain payments). Since we do not want even owners to be able to modify these directly, once deployed, and used, these files should have a a security descriptor associated giving write access only to the System i.e. decentralized consensus.
Question is: was security compromised in any way?
It was not.
The above permissions indicate that only owner used to have write permissions on the ‘token-pools’ folder.
The important questions is, who was the actual owner.
Since neither ‘token-pools’ directory nor the files within used to have explicit security descriptors associated, implicit ones would be used. And these would render the ‘System’ state-domain as the actual owner.
Thus, as a result the person who registered the token pool would have no control over files located within the System State Domain.
In any case for security reasons it undeniably was good that we’ve taken care of this by assigning explicit system-only security descriptors as this imposes an additional layer of security.
I went ahead and described the entire update procedure right over here.