The contractor with whom it shared the data has a vulnerable, unpatched network.
Source: Threadpost