The matching engine and the ring of servers around it are not accessible via internet. You can only connect to them if you have a server collocated in Carteret, and even then the NASDAQ machines only expose the ports relevant to order entry and feed data.

They could have hacked a customer (say, citigroup) and entered that way, but all they really could do is incur losses for the customer.