Hacker News Reader

If I had to guess between "Inside job" and "Their CI system was owned", it may be neither, of course, but of the two I'd bet on the latter.

In this case they had publicly posted the bug fix on GitHub hours before the attack.