But I wonder, can their response be trusted? I mean, it's either malice or incompetence or a complete fluke accident, and the third one is the only one they'll admit to, right?
My bet is one coder fired and it's called out as an isolated incident by one bad actor skipping established policy. Whether that's true, well...
Malice is the first thought that comes to my mind. Perhaps a security vulnerability allowed somebody to access people's devices. It sounds exactly like the type of joke a curious hacker would play.