I’m a bit confused by the wording here, does it mean the credentials were hacked and then used to perform a mass distillation campaign?

It triggers me when these companies think that users are fool. I would have appreciated them, if they have disclosed things more transparently.

"mass distillation campaign" there's no public evidence of this. I wonder what OpenCode/Anomaly has, would be an interesting postmortem.

Obviously they don't want to share details because it's ongoing

Yes

[dead]