That was probably the easiest part of their escapade, sadly — spoofing a WiFi access point with a fake portal comes to mind. Or posing as IT and mass-emailing the university directory (which are rather easy to scrape at most universities), keyloggers on lab computers, etc. Always possible that it could have been as simple as just asking!

Out of ~20,000 students and ~10,000 staff, they only needed to get lucky once, unfortunately.