Well, there's enough for an educated guess. My own reading was "someone used a root privilege escalation to ferret out ssh private keys, and then used them to

Well, there's enough for an educated guess. My own reading was "someone used a root privilege escalation to ferret out ssh private keys, and then used them to log into our cloud as the admin with the compromised key." (I don't see an implication that ssh itself was configured to allow root access.) But there are other open questions --- the two of most interest to me are: What was the root privilege escalation that coughed up the credentials in the first place, and could the attacker have used it to do something else? Also, what was the extent of the compromised "zone", and how sure are they that the network partitioning held?