Some variety of exploits probably lead to this, for example communication to their internal servers from their public servers may not have been isolated well en

Some variety of exploits probably lead to this, for example communication to their internal servers from their public servers may not have been isolated well enough from the outside world (providing a proverbial window into their internal system of services, databases, and APIs). I'd imagine that Riot Games operates a plethora of servers with one, central, very large database containing all customer billing information. Large-scale attacks are usually coordinated with a collection of exploits, for example SQL injection can provide a means to utilize XSS for exploiting administrative interfaces leading to session hijacking. This can be useful for reconnaissance and analysis.