Intruders spent five days inside third-party-hosted business applications before the company noticed.