Might be. Did it happen or not?
Paraphrasing the article, the issue is that they operate without oversight or accountability so there's no way of knowing (this is arguably the story, not that PII may be leaked). The SSA's own security team is not allowed to review their work.
Yes, I think that’s where the “bait” characterization comes from.