Russian mil. hacked US voting SW company, spearphished 122 election officials

How legit does this seem to people? It appears to be the scenario many dreaded: phishing, TFA, MITM.

But then they only have their google accounts... not sure what the vector would be to the voting machines or their code, but having email dirt on employees could be powerful leverage.