While unfortunately in french, the detailed write-up of the hack [0] is worth a read.

The first step was finding out the pre-prod sever through the hash of the site's favicon in Shodan [1]

[0] https://yggleak.top/fr/home/ygg-dossier#le-hack

[1] https://blog.shodan.io/deep-dive-http-favicon/