Very possible there were creds etc accessible in Servicenow that could have been used to move laterally from there. Conjecture, obviously.