They state that the attack possibly occurred the next day, so it is possible that the attacker did disable backups.
It was exactly 31 days later, but still on a reasonable schedule for a monthly backup. Either the backups where disabled or the staff don't trust the backups they do have (though that seems unlikely, given that it would allow them to recover the content offline without having to execute any of the backing code)