The report doesn't mention how the intrusion was discovered. Someone just noticed the RPi one day? 500mb traffic to a Chinese IP?