They actually used the phrase "spear phishing", but then failed to describe it properly. Spear phishing is much more targeted, sometimes as finely honed to one or two people.

Of course, the rhetoric is always hyped. I've seen over the years where individual connections in a port scan was counted as a separate attack. Without details, this could be similarly "simple".