I wonder why the say "appears to have had," is that an assumption or was it stated somewhere? Without an offline backup, it would indeed be a very serious problem, more than it already is.
My reading is: "The agency would surely be panicking more than this if they didn't have an offline backup".
"Offline backup", as in "thousands of shelves full of dusty binders spread across offices all over the country"?
Yup. Everyone’s job safe for the next few years!
"And to think that we just finished digitizing all those paper files five years ago! Oh well, back to square one..."
I think the "offline" part is what is that "appears" to be, clearly they have backups somewhere, but maybe the attacker just missed to wipe some other "online" location.
I interpreted this as a vagueness related to the reporting accuracy, not the existence of a backup.