That's old school. targeted attacks today, hone in on critical infrastructure before striking.

Many times data is exfiltrated beforehand, backups are deleted. If someone went the trouble of compromising a 3rd party software vendor, he knows what he is doing.