"There was no hack involved"
...
"There was a URL exploit"
I suppose that if your system is vulnerable to a "URL exploit" that's not _technically_ a hack in the strictest sense of the word, but the barn door was still wide open for the possibility of their system being hacked, so I don't see how there is any meaningful difference.