The only blessing in this story is that the miscreants made their damage so plainly obvious that the problems were identified quite quickly.

If they'd been a bit more subtle and a little patient, they could've engaged in massive identity theft and financial fraud without ever making it clear that AirBNB was the attack vector.