This was not a case of stolen credentials, but rather of vulnerability exploitation.