It wasn't a management console compromise, it was an old API key that got leaked.