Awaiting for detailed breakdown of the incident. I am more interested in knowing , how can a distillation attack leak / expose credentials.

No I think they used the stolen API keys to perform distillation.