I'm guessing (and it is just that) that the attacker had indeed compromised some element(s) of BA's Web server infrastructure. The reason this report doesn't m

I'm guessing (and it is just that) that the attacker had indeed compromised some element(s) of BA's Web server infrastructure. The reason this report doesn't mention it, is that their analysis focuses on publicly facing changes, so they can find the change to the JS file but not the mechanism that was used to get it onto the server. For that we'd need some statement from BA or some other intel. source that has more information on that aspect.