Andrew Miklas wrote in a comment: The attacker gained unauthorized access to an administrative panel provided by one of our hosting providers.

There have been several breaches in the last months where this was the main cause and it's something almost impossible to defend against – unless you're running your own datacenter hardware, which is very hard to get right.

Few providers properly secure their control panels with 2FA, even though these admin panels are an attractive target and almost always provide full access to the system.