Yes, it was a combo of either calling from any number and guessing the PIN (which was also likely to be still the default) or number spoofing to bypass the PIN altogether.