Hacker News Reader

I guess it implies that the attack was from the inside?

Inside attack / insider's admin account credentials compromised / admin panel itself compromised. Would love to see an RCA on this.