Your State may be different, but New York's Freedom of Information Law (or FOIL, we like to be different) works like this:
The agency has to respond within five business days, but that response can read something like:
We have received your request for public records pursuant to FOIL. Due to the complexity of the records you have requested, it may not be possible to produce them within the standard 20-day statutory period. We anticipate that we will be able to produce the records you have requested within 40 days. If you have questions or concerns, please direct them in writing to the address above.
If they run into a snag, they have to inform you of this and produce the records within a "reasonable period".
So it's not like NYC was under a five-day time crunch here. They could easily have responded and said it would take 40 or 60 days, being as there were several million records requested. That's definitely long enough to bring in a consultant (or even one of the more technically-literate staff members) to properly secure the data.