Did you use pull payments or issue any lnurl withdrawals externally?
I was connected with LIT via node connect (using passphrases). I've noticed a foreign session which was probably used by the attacker