The leak was via a compromised Okta SSO login (why anyone still uses them is a complete mystery to me).