Investigations are still underway to confirm how to do such hack happen
it is easy to note that it is not a hacking in the database, but access to sensitive data through admin powers, so it is likely that they were able to hack the computers of some workers who have access to sensitive data.
It is one of the drawbacks of working from home and employees may not have checked the links before clicking on them.
The attack is a scandal in every sense of the word.