No, we can't conclude that yet. Gab modified their instance heavily from Mastodon code over several years. People are also pointing to an addition made by Gab,

No, we can't conclude that yet. Gab modified their instance heavily from Mastodon code over several years. People are also pointing to an addition made by Gab, where an SQL query is used without input sanitization, as a possible culprit for the breach.