That hasn't been released, but I think it's interesting that the original press releases frames this as a matter of fraud rather than a breach.

I personally doubt this will be revealed to be a software security issue.