My first question would be if the Chinese hacker is American looking or if he is named Boejing Wang or something like that.

Jokes aside there are a huge number of mobile devices with saved credentials for exclusive business VPN access and a lot of businesses restrict access to resources based on the source of requests, which can be the corporate network of a supplier. This is often done to enable some forms of electronic data interchange. Putting these services in another network would probably have helped.

It would be my guess that the hacker gained access through a privileged network with stolen VPN credentials. There would be countless ways to achieve that.

Perhaps pickpockets should just sell the stolen phones to relevant companies.