So is the story here that someone targeted and broke into a mongoDB employee's email account, found a password for an admin panel, then used that to extract det

So is the story here that someone targeted and broke into a mongoDB employee's email account, found a password for an admin panel, then used that to extract details stored by Buffer to access people's FB & Twitter accounts? I wonder if Buffer was the target, or if it was just the first valuable thing the attacker happened across?