I agree with the first part of that and would add that I don't see a statement that it didn't get in through social engineering.

I wouldn't be surprised if it just got access through prompting employees for information through official seeming communications.