They didn't host production and the website on the same server. The attacker had access to the whole network. After that was detected and cleared, the attacker

They didn't host production and the website on the same server. The attacker had access to the whole network. After that was detected and cleared, the attacker was still able to change DNS records. The domain was redirected to an attacker controlled site (https://github.com/matrixnotorg/matrixnotorg.github.io https://github.com/matrixnotorg/matrixnotorg.github.io) where some logs of the production servers where posted.