There is a more detailed followup today: https://news.gandi.net/en/2017/07/detailed-incident-report/
This makes no sense - how did the attacker get between gandi.net and their technical partner in order to MITM them? MITMs aren't magic - simply sending an unencrypted password somewhere doesn't result in it becoming public knowledge unless a router or switch in the path is malicious.
On the top of my head, bgp hijacking perhaps?
> MITMs aren't magic
No. But do not trust the network. Ever.
And no, don't trust the network, but "the network isn't trustworthy" is not a diagnosis, only a potential risk factor. "X entity used BGP hijacking to situate their router between me and Y" is a diagnosis.