I think the prev. comment is accurate in the sense that Mastodon can easily be vulnerable to social engineering attacks, because as long as humans run it, humans are going to make mistakes. To be super clear, any (chat/microblogging/etc) software is going to be vulnerable to social eng attacks.

In most cases, I do consider gaining authorized access via social engineering to be a hack. I guess this probably qualifies, but just barely. If it turns out it was just a rogue engineer then it doesn't qualify at all. It's not clear that external "hackers" gained ongoing access. If someone leveraged an insecure remote worker's PC to gain access, that counts as hacking too. I'll wait and see if we find out what the root cause was.