At the very end they speculate it was a social engineering attack at their registrar that started last year and affected multiple domains. Oddly, the author says they weren’t ”the injured party” and therefore didn’t ask the registrar to verify that. I’m not stating the registrar because there’s no supporting evidence that they were at fault but the author gave it in the article.