Customer had somehow stored an sqlite database in /var/subdomain/sub.domain/data
It’s a folder they can’t even access but the sqlite database for mediawiki was stored there.
The transfer didn’t copy the data folder from the subdomain folder parallel to the html symlink.