Did they say how the artifactory hack worked - did it involve JWTs?

First via ssrf -> groovy plugin and second via specially crafted package I believe.