Has there been any confirmation of this from a source other than X? It's weird that that's the only source, and therefore makes me distrust the entire story.

someone above mentioned it's been confirmed as nx console here: https://github.blog/security/investigating-unauthorized-acce...