They got in via a Back Door.
A lot of places sell DDoS protection. Most of it only ever cover the basics. With the size of botnets, hacked computers, etc that are easily and cheaply available for rent - a lot of so called DDoS protection services can't compete.
You really need to dig deep into what they mean by DDoS protection.
What layers are covered? What type of services are covered?
Also e.g. when they mention they cover volumetric attacks, it's often marketing more than the real deal.
E.g. a provider sells $x of total protection (that number means across all PoPs, so usually $x / 30 or less). It can still go down if you focus all your attacks on a few PoPs that matter.