It wasn't their production environment that was compromised; it was their source code repository.