how to remove dangerous stuff from old CVS commits?

Cleaning up after a former employee, I've found that they accidentally included 800MB of data files in a commit to CVS years ago. Several other commits to the same project were made afterwards. This data is extremely security sensitive and legally restricted and it needs to be removed completely (nothing hanging about in the Attic or filesystem anywhere). How do I get rid of the files without corrupting CVS? (It's a linux host, and I have root access and am CLI fluent, but not a CVS expert!)