I don't know the specifics here but many official sites also can have compromised parts, e.g. a subdomain with an old wordpress install or similar can get taken

I don't know the specifics here but many official sites also can have compromised parts, e.g. a subdomain with an old wordpress install or similar can get taken over.