Tamper Protection Removal Tool

It sounds like they didn't complete their job.

If they delete some/all the computers in Sophos Central (select all and choose delete), there is a report page for all the deleted devices and their password - https://cloud.sophos.com/manage/reports/deleted-devices/create

This report can be exported to a csv file.  If you had this you could create a script which extracts the right password for the local computer (based on name) and uses SEDCli.exe to disable tamper protection. From there you can do whatever.

This would be one option but you would need that export, It is a 1 minute job to delete all the computers and export the report. 

They could also disable Tamper for all computers globally - https://cloud.sophos.com/manage/config/settings/tamper-protection - for any computers that are managed and still able to get policy, this would disable tamper.  I think there is a change coming that disables tamper protection when you delete a computer.  I don't think that change has been released yet.

maybe someone was only hoping to get some help cracking some computers after an infiltration.

maybe someone was only hoping to get some help cracking some computers after an infiltration.