Andrew Miklas wrote in a comment:
<i>The attacker gained unauthorized access to an administrative panel provided by one of our hosting providers.</i><p>There have been several breaches in the last months where this was the main cause and it's something almost impossible to defend against – unless you're running your own datacenter hardware, which is very hard to get right.<p>Few providers properly secure their control panels with 2FA, even though these admin panels are an attractive target and almost always provide full access to the system.