How can you be certain that the hash theft attack was in progress for at least 14 days or so? (And presumably what you are implicitly suggesting is that it was only noticed over the weekend as it might have scaled up to a much higher level?)
I have a rig #19 so to speak. Running BAMT, mounted over NFS, quality Ethernet switches, ethernet wiring I have done myself. The rig has 4x R9 280x, undervolted to 1.131V, mem to 1500, clock to 1050. cgminer 3.7.2 Each card mines 730 kHash. Quality PSU (Chiftec or HP).
Internet line over single mode optics. Other rigs were mining rock solid all the time. But this rig had constant load drops - for a 30 seconds, then back up.
Then the other rig started to act the same way. At that other rig I found strange connects.
I implemented filters ASAP.
Both rigs (with all other rigs) are mining 100% null problems since then.
Suggests a user of remote shell account on compromised server(s) ... what is it 3 IP's now that have been traced ...
many pages ago there was a post regarding the hacker group "Anonymous" ...