It wasn't a break-in that released the data. They shut down the website in the face of the DDoS. When they brought it back up, their backup copy allowed unfet

It wasn't a break-in that released the data. They shut down the website in the face of the DDoS. When they brought it back up, their backup copy allowed unfettered access to their server. No exploits were required. They essentially posted all of this information online of their own accord.