I agree with people saying this was probably a physical attack. Wait to see which co-worker stops coming in?

I'm not sure though because of the backups you exposed and the coins left behind makes it seem like an out of date wallet could have been used. Can you examine the coins remaining and see if they are the newest addresses somehow? Was it a truly trivial amount left behind or something a thief would normal take?