3 ms·

They had the credentials for the user account under which the private keys were stored. This is a post-exploitation concern, not a vulnerability.