I thought the same - I saw no evidence that WordPress or Drupal were an attack vector used at any point to get the information. You could say "someone in the co

I thought the same - I saw no evidence that WordPress or Drupal were an attack vector used at any point to get the information. You could say "someone in the company was using an old kettle, and then they got hacked, so make sure you get new kettles." Of course you should be keeping your installation of WordPress/Drupal or whatever up to date, but it's not obvious how relevant that is to this conversation.