If they got information from an insider, it could potentially be insider trading. Something somewhat similar happened when MedSec shorted St. Jude before publishing some security research about some hardware: https://arstechnica.com/information-technology/2016/08/tradi...
I don't believe that case was considered insider trading but I may be mistaken.