In most publicly reported cases, the attackers had already been inside the compromised systems for weeks, months, or even years before the intrusions were finally detected. Similar cases have been found in Finland and in other countries and organizations all over the world. One public example is from Japanese Finance Ministry that was infected with trojans. According to the news, the trojan was free to steal confidential data from January 2010 to November 2011. (Techworld, 2012). That is almost two years and probably plenty of information was lost. Sometimes intrusions have been made by professionals, but in some cases there has simply been malware or trojan infections that has not been noticed by anyone.
During this time systems have probably been monitored by administrators or even audited by internal or external organizations. Either there has not been proper monitoring by administrators, auditing included only paper review or technical audit focused only on compliance. It is possible that signs of intrusions were there and visible in the monitoring systems but were simply ignored by administrators or auditors for some reason. It is also possible that audit method and tools did not enable detection of intrusions or other malicious activity.