"As reported" includes a line I think most people are overlooking: "including using stolen credentials".

Without more information I'm inclined to think it found something on the internet (which shouldn't be a surprise to anyone) and managed to log in, rather than hack in, and they might by hyping up parts of this.