In the past, Datacarry has almost exclusively used phishing as their first penetration of systems. (Exploits follow for escalation, but not generally penetration.)

Whilst we don't know exactly what they did here, a secure programming language will do bupkus when you're targeting the meatbag behind the keyboard. We need to treat people like infrastructure, that can and will eventually fail.